Starstruk Logo MarkStarstruk

0.54.1

dgtlmoon/changedetection.io0.54.1Feb 23, 2026by dgtlmoon

AI Summary

Critical security release addressing two CVE vulnerabilities - an SSRF vulnerability via watch URLs and a reflected XSS in RSS Single Watch requests. Users needing access to IANA reserved addresses must set an environment variable.

Key Highlights

  • Fixed CVE-2026-27696 - SSRF via Watch URLs
  • Fixed CVE-2026-27645 - Reflected XSS in RSS Single Watch
  • Added ALLOW_IANA_RESTRICTED_ADDRESSES env var for IANA reserved URLs

New Features

  • ALLOW_IANA_RESTRICTED_ADDRESSES environment variable to access IANA reserved URLs (169.254.169.254, 10.0.0.1, 127.0.0.1, etc.)

Full Release Notes

- CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var `ALLOW_IANA_RESTRICTED_ADDRESSES` to `true` to access IANA reserved URLs such as http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/, etc.
- CVE-2026-27645 - Reflected XSS in RSS Single Watch request

**Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.53.7...0.54.1