CVE-2025-52558 json
ChangeDetection.io XSS in watch overview
published 2025-06-23 16 mo ago modified 2026-07-07 4 mo ago also EUVD-2025-18945 , GHSA-hwpg-x5hw-vpv9 , PYSEC-2026-1241
- cvss
- 7.0
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting (XSS) vulnerability. This issue has been patched in version 0.50.4
Patch / fix
- pypi changedetection-io 0.50.4
- changedetection changedetection 0.50.4
- webtechnologies changedetection 0.50.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | changedetection-io | <0.50.4 |
0.50.4 |
Affected products
- dgtlmoon changedetection.io
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/dgtlmoon/changedetection.io/commit/3d5a544ea674cfce517adcd498877a8d760d0931
web
-
github.com
/dgtlmoon/changedetection.io/security/advisories/GHSA-hwpg-x5hw-vpv9
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-52558
advisory
-
github.com
/dgtlmoon/changedetection.io
package
-
pypi.org
/project/changedetection-io
package
-
github.com
/advisories/GHSA-hwpg-x5hw-vpv9
advisory
Sources
- CVE List CVE-2025-52558
- GitHub Advisory GHSA-hwpg-x5hw-vpv9
- NVD CVE-2025-52558
- OSV PYSEC-2026-1241
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.