Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

Fix availableCritical · CVSS 10EPSS 83.6%

Published Oct 15, 2024 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: changedetection.io 0.45.21.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIchangedetection.io4,413 downloads/week

Vulnerable versions
<= 0.45.20
Fixed in
0.45.21

Check your project: pip show changedetection.io

Sources

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

← All critical vulnerabilities