CVE-2026-29038: 
Python vulnerability analysis and mitigation

CVE-2026-29038 is a reflected cross-site scripting (XSS) vulnerability in the /rss/tag/ endpoint of changedetection.io, an open-source web page change detection tool. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping, and because Flask returns text/html by default for plain string responses, injected JavaScript is parsed and executed by the browser. All versions prior to 0.54.4 are affected; the vulnerability persisted in v0.54.1, which had patched an identical issue in /rss/watch/ (CVE-2026-27645) but missed the same pattern in tag.py. It was published on March 4, 2026, with a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in changedetectionio/blueprint/rss/tag.py at line 36, where the tag_uuid URL path parameter is interpolated into an f-string error response with no HTML escaping: return f"Tag with UUID {tag_uuid} not found", 404. Flask's default Content-Type: text/html; charset=utf-8 causes the browser to render and execute any embedded HTML or JavaScript. Exploitation requires a valid RSS access token — a 32-character hex string that is exposed unauthenticated in the HTML source of the application's homepage — lowering the barrier for attackers to craft malicious URLs. A public proof-of-concept is included in the GitHub security advisory (Github Advisory, Patch Commit).

Successful exploitation enables session cookie theft via document.cookie exfiltration, account takeover if session cookies lack the HttpOnly flag, and phishing attacks via crafted URLs that appear to originate from a trusted changedetection.io instance. The vulnerability affects confidentiality and integrity of user data but has no direct availability impact. Prior scanning of internet-facing instances during related CVE-2026-27645 research identified over 500 publicly accessible deployments, indicating broad potential exposure (Github Advisory).

A public proof-of-concept exploit is documented in the GitHub security advisory, demonstrating JavaScript execution via a crafted GET request to /rss/tag/<payload>?token=<rss_token>. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.029% (6th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing changedetection.io instances (versions ≤ 0.54.1) using tools like Shodan or Censys, or by directly visiting the target's homepage.
2. Extract RSS token: Visit the target's homepage without authentication and inspect the HTML source to locate the RSS access token (a 32-character hex string) embedded in a <link> or similar tag.
3. Craft malicious URL: Construct a URL with a JavaScript payload URL-encoded in the tag_uuid path segment, e.g.:

   http://target:5000/rss/tag/%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E?token=<EXTRACTED_TOKEN>

4. Deliver to victim: Send the crafted link to a user with an active session on the changedetection.io instance via phishing email, chat, or other social engineering.
5. Trigger execution: When the victim clicks the link, the server responds with a 404 containing the unescaped payload in an text/html response; the browser executes the injected JavaScript in the victim's session context, enabling cookie theft or other malicious actions (Github Advisory).

• Network: HTTP GET requests to /rss/tag/ containing URL-encoded HTML or JavaScript characters (e.g., %3C, %3E, %22, onerror, script, alert) in the path segment; outbound requests from the victim's browser to attacker-controlled domains following interaction with a suspicious RSS tag URL.
• Logs: Web server access logs showing 404 responses to /rss/tag/ with unusual or encoded characters in the tag_uuid path parameter; repeated requests from different IPs to the same malformed tag endpoint.
• File System: No direct file system artifacts expected for reflected XSS; however, if session hijacking occurs, look for unexpected new sessions or configuration changes in the changedetection.io datastore.
• Process/Application: Unexpected JavaScript-driven actions within the application (e.g., unauthorized watch additions, setting changes) that correlate with a user clicking an external link (Github Advisory).

Upgrade changedetection.io to version 0.54.4 or later, which applies the fix in commit ec7d56f by HTML-escaping the tag_uuid parameter using markupsafe.escape() before reflecting it in the response (Release 0.54.4, Patch Commit). If immediate patching is not possible, restrict access to the /rss/tag/ endpoint using a web application firewall (WAF) rule or network access controls to limit exposure to trusted users only. Additionally, ensure session cookies are configured with the HttpOnly flag to reduce the impact of any successful XSS exploitation.

The vulnerability was reported by Roberto Nunes (@Akokonunes) and neo-ai-engineer (@neo-ai-engineer), who also discovered the related CVE-2026-27645 and noted that the prior patch was incomplete. The advisory was published by the maintainer (dgtlmoon) on March 4, 2026, and the fix was released the same day in version 0.54.4 alongside two other CVEs (CVE-2026-29039 and CVE-2026-29065). The disclosure highlights a common incomplete-patch scenario where a fix for one endpoint does not address the same vulnerability pattern in a sibling endpoint (Github Advisory, Release 0.54.4).