High
ChangeDetection.io XSS in watch overview
Type: advisorySources: OSV
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting (XSS) vulnerability. This issue has been patched in version 0.50.4
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-52558
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:11 UTC · Revision 1
Source evidence
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting (XSS) vulnerability. This issue has been patched in version 0.50.4
osv:CVE-2025-52558
Complete source record
{
"id": "82bc646375442263e4bf238d762760c18120c21218670939cedbd613183e637d",
"url": "https://osv.dev/vulnerability/CVE-2025-52558",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ChangeDetection.io XSS in watch overview",
"summary": "changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting (XSS) vulnerability. This issue has been patched in version 0.50.4",
"evidence": "osv:CVE-2025-52558",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-52558",
"aliases": [
"CVE-2025-52558",
"GHSA-hwpg-x5hw-vpv9",
"PYSEC-2026-1241"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/dgtlmoon/changedetection.io",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b77105be7b9774ff1cb2aa9b9d2d6252366b052d"
},
{
"fixed": "3d5a544ea674cfce517adcd498877a8d760d0931"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.50.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "3d5a544ea674cfce517adcd498877a8d760d0931"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.50.3",
"0.50.2",
"0.50.1",
"0.50.01",
"0.49.18",
"0.49.17",
"0.49.16",
"0.49.15",
"0.49.14",
"0.49.13",
"0.49.12",
"0.49.11",
"0.49.10",
"0.49.9",
"0.49.8",
"0.49.7",
"0.49.6",
"0.49.5",
"0.49.4",
"0.49.3",
"0.49.2",
"0.49.1",
"0.49.0",
"0.48.06",
"0.48.05",
"0.48.04",
"0.48.03",
"0.48.01",
"0.48.00",
"0.47.06",
"0.47.05",
"0.47.04",
"0.47.03",
"0.47.01",
"0.47.00",
"0.46.04",
"0.46.03",
"0.46.02",
"0.46.01",
"0.46.00",
"0.45.26",
"0.45.25",
"0.45.24",
"0.45.23",
"0.45.22",
"0.45.21",
"0.45.20",
"0.45.19",
"0.45.18",
"0.45.17",
"0.45.16",
"0.45.15",
"0.45.14",
"0.45.13",
"0.45.12",
"0.45.10",
"0.45.9",
"0.45.8.1",
"0.45.8",
"0.45.7.3",
"0.45.7.2",
"0.45.7.1",
"0.45.7",
"0.45.6",
"0.45.5",
"0.45.4",
"0.45.3",
"0.45.2",
"0.45.1",
"0.45",
"0.44.2",
"0.44.1",
"0.44",
"0.43.2",
"0.43.1",
"0.43",
"0.42.3",
"0.42.2",
"0.42.1",
"0.42",
"0.41.1",
"0.41",
"0.40.3",
"0.40.2",
"0.40.1.1",
"0.40.1.0",
"0.40.0.4",
"0.40.0.3",
"0.40.0.2",
"0.40.0",
"0.39.22.1",
"0.39.22",
"0.39.21.1",
"0.39.21",
"0.39.20.4",
"0.39.20.3",
"0.39.20.2",
"0.39.20.1",
"0.39.20",
"0.39.19.1",
"0.39.19",
"0.39.18",
"0.39.17.2",
"0.39.17.1",
"0.39.17",
"0.39.16",
"0.39.15",
"0.39.14",
"0.39.13.1",
"0.39.13",
"0.39.12",
"0.39.11",
"0.39.10",
"0.39.9",
"0.39.8",
"0.39.7",
"0.39.6",
"0.39.5",
"0.39.4",
"0.39.3",
"0.39.2",
"0.39.1",
"0.39",
"0.38.2",
"0.38.1",
"0.38",
"0.37",
"0.35",
"0.34",
"0.33",
"0.32",
"0.31",
"0.30",
"0.29",
"0.28",
"0.27",
"0.26",
"0.25",
"0.24",
"0.23",
"0.22",
"0.21",
"0.2",
"0.12",
"0.11",
"0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52558.json"
}
}
],
"modified": "2026-10-28T02:30:37.986556155Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52558.json",
"https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hwpg-x5hw-vpv9",
"https://nvd.nist.gov/vuln/detail/CVE-2025-52558",
"https://github.com/dgtlmoon/changedetection.io/commit/3d5a544ea674cfce517adcd498877a8d760d0931"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52558.json"
}
},
"related_cves": [
{
"value": "CVE-2025-52558",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505191,
"published_at": "2025-06-23T20:52:24.343+00:00"
}