CVE-2024-32651criticalCWE-1336

CVE-2024-32651: critical vulnerability in dgtlmoon changedetection.io

Server Side Template Injection in Jinja2 allows Remote Command Execution

Published · Updated

Follow this CVE+ Monitor changedetection.io+ Monitor changedetection-io

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 10epss 85%
from disclosure to weapon31 days
Published on NVDApr 25
1st PoC+31d
In short

changedetection.io has a critical vulnerability where attackers can inject malicious code into Jinja2 templates, allowing them to run any command on the server. This means someone could take complete control of the entire system without needing a password.

Technical detail

A Server Side Template Injection (SSTI) in Jinja2 template processing enables unauthenticated remote code execution (RCE) on the host system. Attackers exploit unsanitized user input reflected in template rendering contexts to break out of the template sandbox and execute arbitrary system commands with server privileges, resulting in complete system compromise.

Summary generated and translated by AI from the official description.
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
dgtlmoon · changedetection.io
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — dgtlmoon changedetection.io

In the same product, most dangerous first.

CVE-2024-51483MEDIUMchangedetection.io Path Traversal vulnerabilityEPSS 2.3%CVE-2024-34061MEDIUMReflected cross site scripting in changedetection.ioEPSS 1.3%CVE-2026-25527MEDIUMchangedetection.io vulnerable to unauthenticated static path traversalEPSS 1.0%CVE-2024-56509HIGHchangedetection.io has Improper Input Validation Leading to LFR/Path TraversalEPSS 0.7%CVE-2024-51998HIGHPath traversal using file URI scheme without supplying hostname in changedetection.ioEPSS 0.7%CVE-2026-95272MEDIUMdgtlmoon changedetection.io Screenshot flask_app.py static_content path traversalEPSS 0.7%