An attacker can exploit a reflected cross‑site scripting vulnerability in the RSS single‑watch endpoint of changedetection.io. The UUID supplied in the request is reflected directly into the HTML response without escaping, allowing malicious JavaScript to be executed in the victim’s browser. This flaw compromises confidentiality, integrity, and availability of the web UI for authenticated and unauthenticated users depending on the endpoint’s exposure. The weakness maps to CWE‑79.

Products affected are the open‑source web page change detection tool changedetection.io from vendor dgtlmoon. All releases before 0.54.1 contain the flaw; version 0.54.1 implements a fix that sanitizes the UUID parameter. No additional product variants are listed.

The CVSS score of 6.1 indicates a medium risk, and the EPSS score of less than 1% shows low likelihood of exploitation at this time. The vulnerability is not catalogued in the CISA KEV list, suggesting no known widespread attacks. Exploitation requires a victim to load a crafted URL in a browser, making it accessible via social engineering or phishing. Because the payload is reflected, an attacker need only supply a malicious UUID; no privileged access or code execution outside the browser context is required.