CVE-2026-92814: changedetection.io through 0.60.6 Cross-Site Scripting via watch_title

Severity: medium (CVSS 4.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-22
Weakness: CWE-79

Description

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

Affected products

dgtlmoon changedetection.io: through 0.60.6

References

https://github.com/dgtlmoon/changedetection.io
https://github.com/dgtlmoon/changedetection.io/blob/0.60.6/changedetectionio/notification/handler.py#L400-L414
https://github.com/geo-chen/oss/blob/main/changedetection.io.md#finding-1-stored-htmlmarkup-injection-into-html-notifications-via-scraped-page-title-watch_title-not-in-the-escape-set
https://www.vulncheck.com/advisories/changedetection-io-through-0.60.6-cross-site-scripting-via-watch-title

Get alerted when CVE-2026-92814 or the next vulnerability affects your stack