ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33981

changedetection.io is a free open source web page change detection tool.

Published Mar 27, 2026 · updated Jun 17, 2026 · webtechnologies changedetection

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the and include filter expressions allow use of the jq builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including , , , and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 27, 2026 · NIST NVD

    Detected

    changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the and include filter expressions allow use of the jq builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including , , , and any secrets pas

  2. Jun 17, 2026 · NIST NVD

    Updated

    changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the and include filter expressions allow use of the jq builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including , , , and any secrets pas

Affected

  • cpe webtechnologies/changedetectionversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33981

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33981

    changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the and include filter expressions allow use of the jq builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated use

    nvd.nist.gov

References