{"cve":"CVE-2026-33981","nvd":{"published":"2026-03-27T22:16:22.793","modified":"2026-10-26T22:10:00.163","status":"Analyzed","description":"changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":8.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-200"],"references":["https://github.com/dgtlmoon/changedetection.io/commit/65517a9c74a0cbe1a4661314470b28131ef5557f","https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7","https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-58r7-4wr5-hfx8","https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-58r7-4wr5-hfx8"],"products":["webtechnologies:changedetection"],"source":"nvd","synced_at":"2026-10-26T22:26:44.656832877+00:00"},"epss":{"cve":"CVE-2026-33981","score":0.00484,"percentile":0.41403,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-58r7-4wr5-hfx8","url":"https://osv.dev/vulnerability/GHSA-58r7-4wr5-hfx8","summary":"Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters","modified":"2026-07-13T07:26:27.597904266Z","packages":[{"ecosystem":"PyPI","name":"changedetection-io","purl":"pkg:pypi/changedetection-io","ranges":["<0.54.7"],"fixed":["0.54.7"]}]},{"id":"PYSEC-2026-2130","url":"https://osv.dev/vulnerability/PYSEC-2026-2130","summary":"","modified":"2026-07-13T07:15:17.067188625Z","packages":[{"ecosystem":"PyPI","name":"changedetection-io","purl":"pkg:pypi/changedetection-io","ranges":["<0.54.7"],"fixed":["0.54.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}