Server Side Template Injection in Jinja2 allows Remote Command Execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.
Summary
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dgtlmoon | changedetection.io | up to 0.45.20 | — | No fix listed | CNA |
| — | changedetection.io (PyPI) | before 0.45.21 | 0.45.21 | Patch available | GHSA-4r7v-whpg-8rx3 |
- changedetection.io Vendordgtlmoon Affected up to 0.45.20 Fixed in — No fix listed CNA
- changedetection.io (PyPI) Vendor— Affected before 0.45.21 Fixed in 0.45.21 Patch available GHSA-4r7v-whpg-8rx3
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dgtlmoon:changedetection.io:0.45.20:*:*:*:*:*:*:* | 0.45.20 | — | — |
- cpe:2.3:a:dgtlmoon:changedetection.io:0.45.20:*:*:*:*:*:*:* Versions 0.45.20 — ·—
Remediation
- Fix · GHSA-4r7v-whpg-8rx3 changedetection.io (PyPI) Fixed in 0.45.21 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-32651
- 2026-10-03 Alias added: GHSA-4r7v-whpg-8rx3
References
Other 8
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3
- https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21
- https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2
- https://blog.hacktivesecurity.com/index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedetection-io/
- https://blog.hacktivesecurity.com/index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedetection-io
- https://github.com/dgtlmoon/changedetection.io
- https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2026-310.yaml
- https://pypi.org/project/changedetection-io
More dgtlmoon vulnerabilities
- TI-2026-27619 changedetection.io has an Authentication Bypass via Decorator Ordering CVSS 3.1CRITICAL 9.8
- TI-2026-23210 changedetection.io: Zip Slip vulnerability in the backup restore functionality CVSS 4.0HIGH 8.8
- TI-2026-62554 changedetection.io through 0.60.6 SSRF via browser-step Goto URL CVSS 4.0HIGH 8.7
- TI-2026-22073 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs CVSS 3.1HIGH 8.6
- TI-2024-37396 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal CVSS 3.1HIGH 8.6
- TI-2024-34886 Path traversal using file URI scheme without supplying hostname in changedetection.io CVSS 3.1HIGH 8.6
Sources
- CVE-2024-32651 · CVE Program
- CVE-2024-32651 · NVD
- FIRST EPSS
- GHSA-4r7v-whpg-8rx3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences