CVE-2026-92814: changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token is used in templates.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of changedetection.io through 0.60.6 are exposed when they monitor a page whose title an attacker can control and send HTML notifications using a template that includes the watch_title token. Notification recipients may receive the attacker-supplied markup as live content in channels such as email and Telegram.
What must an attacker do to exploit it?
An attacker needs to cause a monitored page to present a malicious title. When changedetection.io scrapes that title and a notification template uses watch_title, the title is inserted into the HTML notification without escaping.
Does this affect every changedetection.io notification setup?
The described injection path requires HTML notifications and use of the watch_title token in the notification template. The provided information does not establish impact for templates that do not include that token.
What can be done before an update is available?
Avoid using watch_title in HTML notification templates for watches of attacker-controlled or untrusted pages. Review notification templates and treat previously received HTML notifications containing scraped titles as potentially untrusted content.