CVE-2026-92814 is a cross-site scripting vulnerability in changedetection.io through version 0.60.6. The application fails to properly escape the scraped page title when generating HTML notifications. Consequently, an attacker can inject malicious markup into monitored page titles, which is then rendered as live content in notification channels like email and Telegram if the watch_title token is used in notification templates. The CVSS 4.0 base score is 2.3, indicating low severity with network attack vector, high attack complexity, and requiring user interaction.

An attacker who controls or influences the monitored page title can inject malicious HTML markup that is delivered live in notification channels such as email and Telegram. This may lead to content injection or script execution in the context of the notification viewer. However, the overall impact is limited by the requirement for user interaction and high attack complexity, resulting in a low severity rating.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using untrusted monitored page titles in notification templates, especially with the watch_title token, and consider disabling or restricting HTML rendering in notifications.