CVE-2026-33981

Received Received - Intake

Environment Variable Disclosure via jq Filter in changedetection.io

Publication date: 2026-03-27

Last updated on: 2026-04-02

Assigner: GitHub, Inc.

Description

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-27

Last Modified

2026-04-02

Generated

2026-07-06

AI Q&A

2026-03-28

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33981

Affected Vendors & Products

Vendor	Product	Version / Range
webtechnologies	changedetection	to 0.54.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The vulnerability exists in changedetection.io versions prior to 0.54.7, where the `jq:` and `jqraw:` include filter expressions allow the use of the jq `env` builtin. This builtin reads all process environment variables and stores them as part of the watch snapshot.

Because of this, an authenticated user—or even an unauthenticated user if no password is set (which is the default)—can access and leak sensitive environment variables. These variables may include secrets such as `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any other secrets passed as environment variables to the container.

The issue was fixed in version 0.54.7.

Impact Analysis

This vulnerability can lead to the exposure of sensitive environment variables and secrets to unauthorized users.

If exploited, attackers could gain access to confidential information such as passwords, URLs, proxy settings, and other secrets used by the application or container.

Such exposure can compromise the security of the system, potentially allowing further attacks, unauthorized access, or data breaches.

Mitigation Strategies

To mitigate this vulnerability, upgrade changedetection.io to version 0.54.7 or later, where the issue has been patched.

Additionally, ensure that a password is set to prevent unauthenticated users from accessing the service, as the default configuration allows unauthenticated access which can lead to sensitive environment variable leakage.

Compliance Impact

The vulnerability allows an authenticated or unauthenticated user (if no password is set) to leak sensitive environment variables, including secrets and credentials. This exposure of sensitive data could lead to non-compliance with data protection standards and regulations such as GDPR and HIPAA, which require the protection of sensitive information and proper access controls.

Specifically, leaking environment variables that contain secrets may violate confidentiality requirements and increase the risk of unauthorized data access, which is contrary to the principles of these regulations.

Hi! I’m here to help you understand CVE-2026-33981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70