CVE-2025-62780: changedetection.io vulnerable to stored XSS in Watch update via API
Summary
A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.
Details
Tested on changedetection.io version v0.50.24
console REPOSITORY TAG IMAGE ID CREATED SIZE ghcr.io/dgtlmoon/changedetection.io latest 0367276509a0 23 hours ago 599MB
When a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message "Watch protocol is not permitted by SAFEPROTOCOLREGEX or incorrect URL format". This is catched by the function validateurl(testurl).
python def validateurl(testurl): # ... from .model.Watch import issafeurl if not issafeurl(testurl): # This should be wtforms.validators. raise ValidationError('Watch protocol is not permitted by SAFEPROTOCOLREGEX or incorrect URL format')
When instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.
PoC
Update an existing watch with an unsafe URL console curl -X PUT "http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282" \ -H "x-api-key: XXX" \ -H "Content-Type: application/json" \ -d '{ "url": "javascript:alert(document.domain)", "title": "XSS PoC", "paused": false }'
Impact
Two scenarios are possibile:
1. An attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. 2. An attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload.
When the user clicks on Preview and then on the malicious link, the JavaScript malicious code is executed.
<img width="1200" height="643" alt="poc1" src="https://github.com/user-attachments/assets/db81e0c7-b6d3-4332-b15d-a688a48c3227" /> <br> <img width="1200" height="643" alt="poc2" src="https://github.com/user-attachments/assets/e704b37c-d339-4322-9fc0-ad50dd86b31d" />
Credits
Edoardo Ottavianelli @edoardottt
Other sources
changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on Preview and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62780?
CVE-2025-62780 is classified as a critical vulnerability due to its potential for Stored Cross Site Scripting.
How do I fix CVE-2025-62780?
To fix CVE-2025-62780, upgrade to changedetection.io version 0.50.34 or later to address the vulnerability.
What are the potential impacts of CVE-2025-62780?
The potential impacts of CVE-2025-62780 include unauthorized script execution and data theft due to Cross Site Scripting.
Which versions of changedetection.io are affected by CVE-2025-62780?
Versions of changedetection.io prior to 0.50.34 are affected by CVE-2025-62780.
Who is at risk from CVE-2025-62780?
Users and administrators of changedetection.io versions before 0.50.34 are at risk from CVE-2025-62780.