CVE-2026-33981
Last modified
CVE-2026-33981 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. EPSS estimates a 0.47% chance of exploitation in the next 30 days.
Description
changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Webtechnologies | Changedetection | < 0.54.7 |
References
- https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7Product, Release Notes
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-58r7-4wr5-hfx8Exploit, Vendor Advisory
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-58r7-4wr5-hfx8Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33981?
How severe is CVE-2026-33981?
How do I fix CVE-2026-33981?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33976Notesnook is a note-taking app. Prior to version 3.3.11 on W…9.6
- CVE-2026-33977FreeRDP is a free implementation of the Remote Desktop Proto…6.5
- CVE-2026-33978Notesnook is a note-taking app focused on user privacy & eas…6.1
- CVE-2026-33979Express XSS Sanitizer is Express 4.x and 5.x middleware whic…8.2
- CVE-2026-3398A vulnerability was determined in Tenda F453 1.0.0.3. Affect…8.8
- CVE-2026-33980Azure Data Explorer MCP Server is a Model Context Protocol (…8.1
- CVE-2026-33982FreeRDP is a free implementation of the Remote Desktop Proto…8.1
- CVE-2026-33983FreeRDP is a free implementation of the Remote Desktop Proto…6.5
- CVE-2026-33984FreeRDP is a free implementation of the Remote Desktop Proto…7.5
- CVE-2026-33985FreeRDP is a free implementation of the Remote Desktop Proto…7.1
- CVE-2026-33986FreeRDP is a free implementation of the Remote Desktop Proto…7.5
- CVE-2026-33987FreeRDP is a free implementation of the Remote Desktop Proto…6.6
Are you affected by CVE-2026-33981?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST