CVE-2026-95657 in Changedetection.io
Summary
by MITRE • 09/22/2026
A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.60.1 is capable of addressing this issue. This patch is called aac6fcfa594f17511b8ff73e5eaa4f6c33899de0. It is suggested to upgrade the affected component.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in dgtlmoon Changedetection.io versions up through 0.55.8 represents a significant security risk rooted in improper neutralization of input during web page generation, commonly classified under CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting. This flaw resides within the visual selector component, specifically affecting the setCurrentSelectedText function located in the static JavaScript file visual-selector.js. The core technical issue arises from the application's failure to adequately sanitize or encode user-supplied data before it is processed and rendered by the browser. When an attacker manipulates the argument s passed to this function, they can inject malicious script payloads that are subsequently executed within the context of the victim's session. This lack of input validation allows for a classic stored or reflected cross-site scripting attack vector depending on how the selected text data is persisted or transmitted back to the client side.
From an operational perspective, this vulnerability enables remote attackers to execute arbitrary JavaScript code in the browsers of users interacting with the visual selector feature. The impact of such execution can be severe, potentially leading to session hijacking where the attacker steals authentication cookies or tokens, allowing them to impersonate legitimate users and gain unauthorized access to sensitive accounts. Furthermore, the injected scripts could perform actions on behalf of the victim without their knowledge, modify page content to facilitate phishing attacks, or redirect users to malicious external sites designed to distribute malware. Since the exploit has been publicly disclosed and is known to be utilizable by threat actors, the window for exploitation is open, making immediate remediation critical to prevent potential compromise of user data and system integrity.
The attack vector associated with this vulnerability aligns with techniques described in the MITRE ATT&CK framework, particularly those involving client-side code injection or browser-based attacks that leverage trusted web applications as a conduit for malicious activity. The remote nature of the exploit means that no physical access or local privileges are required by the attacker; instead, they can target users through social engineering tactics such as embedding malicious links in emails or websites that trigger the vulnerable function when visual selection features are utilized. This broadens the scope of potential victims beyond just internal administrators to any user who interacts with the affected interface elements while logged into an instance running a susceptible version of Changedetection.io.
To mitigate this risk, it is strongly recommended to upgrade the application immediately to version 0.60.1 or later, which incorporates the necessary code changes to address these input validation deficiencies. The specific patch resolving this issue is identified by commit hash aac6fcfa594f17511b8ff73e5eaa4f6c33899de0, which likely introduces proper encoding or sanitization logic within the setCurrentSelectedText function to ensure that special characters are neutralized before being processed. In addition to upgrading, organizations should implement strict Content Security Policy headers to limit the sources from which scripts can be executed, thereby providing an additional layer of defense against cross-site scripting attacks even if similar vulnerabilities exist in other parts of the application. Regular security audits and code reviews focusing on input handling practices are also advised to prevent future occurrences of CWE-79 related issues across all components of the software stack.