CVE-2025-62780 Overview
CVE-2025-62780 is a Stored Cross-Site Scripting (XSS) vulnerability in changedetection.io, an open source web page change detection tool. The flaw exists in the Watch update API in versions prior to 0.50.34 due to insufficient security checks on user-supplied URLs. An authenticated attacker can create or modify a watch so that its URL field contains a JavaScript payload. When a legitimate user previews the watch and clicks the malicious link, the payload executes in the victim's browser context. The maintainers addressed the issue in version 0.50.34.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the browser of any user who previews a malicious watch, enabling session theft, account takeover, and further pivoting within the changedetection.io instance.
Affected Products
- changedetection.io versions prior to 0.50.34
- Self-hosted deployments of changedetection.io Watch API
- Docker and container-based installations tracking web page changes
Discovery Timeline
- 2025-11-10 - CVE-2025-62780 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62780
Vulnerability Analysis
The vulnerability is classified as Stored Cross-Site Scripting under [CWE-79]. The Watch update API accepts arbitrary URL values without validating that the content matches an expected URL structure or scheme. changedetection.io retrieves and stores the target page content for later comparison, and the Preview functionality renders links that trace back to the stored URL field.
Two exploitation scenarios are documented. In the first, an attacker inserts a new watch pointing to a legitimate URL. After the HTML content is retrieved and stored, the attacker updates the URL field with a JavaScript payload such as javascript: scheme content. In the second, an attacker substitutes the URL in an existing watch with a JavaScript payload directly.
Exploitation requires low privileges and user interaction. The victim must open the Preview view and click the manipulated link, at which point the browser executes attacker-controlled JavaScript in the origin of the changedetection.io instance.
Root Cause
The root cause is missing input sanitization and scheme validation on the URL field within the Watch update API. The application does not enforce that stored URL values use http or https schemes, allowing javascript: URIs to persist and later render as clickable links in the Preview interface.
Attack Vector
The attack vector is network-based and requires an authenticated attacker with permission to create or modify watches. The attacker submits a crafted payload through the Watch update API. Execution triggers when another authenticated user, typically an administrator reviewing changes, opens the Preview page and interacts with the malicious link.
No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-4c3j-3h7v-22q9 for maintainer-provided technical detail.
Detection Methods for CVE-2025-62780
Indicators of Compromise
- Watch entries containing URL fields that begin with javascript:, data:, or other non-HTTP schemes
- API requests to the Watch update endpoint that modify only the URL field of existing watches shortly after creation
- Unexpected outbound requests or DOM modifications originating from the changedetection.io web interface
Detection Strategies
- Audit the watch database for URL values that do not begin with http:// or https://
- Review web server access logs for PUT or POST requests to /api/v1/watch endpoints with anomalous payloads
- Monitor browser console errors or Content Security Policy (CSP) violations reported by users accessing the Preview interface
Monitoring Recommendations
- Enable request logging on the changedetection.io reverse proxy to capture full API payload metadata
- Correlate watch creation and subsequent URL update events performed by the same account within short time windows
- Alert on any Preview page access followed by unusual authenticated actions from the same session
How to Mitigate CVE-2025-62780
Immediate Actions Required
- Upgrade changedetection.io to version 0.50.34 or later without delay
- Audit all existing watches for malicious URL values and remove any entries containing script schemes
- Rotate API tokens and session credentials for accounts that may have been exposed to the Preview page
Patch Information
changedetection.io version 0.50.34 fixes the vulnerability by adding security checks on URLs submitted through the Watch update API. The fix is described in the GitHub Security Advisory GHSA-4c3j-3h7v-22q9. Users on any prior release should treat the upgrade as the primary remediation.
Workarounds
- Restrict access to the changedetection.io web interface to trusted operators only until the patch is applied
- Deploy a reverse-proxy Content Security Policy that blocks inline script execution and javascript: URIs
- Disable or limit the Preview functionality for accounts that do not require it
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
