PyPI: changedetection-io
CVE-2025-62780
Safety vulnerability ID: SFTY-20251112-49922
Safety legacy ID: pyup.io-81578
Affected versions of the changedetection.io package are vulnerable to Cross-site Scripting (XSS) due to missing URL safety validation in the Watch update API. In the browser interface, changedetection.io calls the validate_url(test_url) helper, which ultimately uses the model.Watch.is_safe_url check to block unsafe schemes such as javascript:, but the Watch update API endpoint (for example, PUT /api/v1/watch/{id}) accepts attacker-controlled URL fields without invoking this validation, allowing storage of script-based URLs in Watch data.
Overview
changedetection.io: Stored XSS in Watch update via API
Advisory
Affected versions of the changedetection.io package are vulnerable to Cross-site Scripting (XSS) due to missing URL safety validation in the Watch update API. In the browser interface, changedetection.io calls the validate_url(test_url) helper, which ultimately uses the model.Watch.is_safe_url check to block unsafe schemes such as javascript:, but the Watch update API endpoint (for example, PUT /api/v1/watch/{id}) accepts attacker-controlled URL fields without invoking this validation, allowing storage of script-based URLs in Watch data.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20251112-49922/CVE-2025-62780
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62780
- https://github.com/advisories/GHSA-4c3j-3h7v-22q9
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9
- https://nvd.nist.gov/vuln/detail/CVE-2025-62780
- https://github.com/dgtlmoon/changedetection.io/issues/3562
- https://github.com/dgtlmoon/changedetection.io/pull/3564
- https://github.com/dgtlmoon/changedetection.io/releases/tag/0.50.34
- https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2025-91.yaml
- https://github.com/advisories/GHSA-4c3j-3h7v-22q9
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more