From ec7d56f85d1e9690fca7cb4711c1fb20dffec780 Mon Sep 17 00:00:00 2001
From: dgtlmoon <dgtlmoon@gmail.com>
Date: Wed, 4 Mar 2026 10:55:49 +0100
Subject: [PATCH] CVE-2026-29038 - Reflected XSS in RSS Tag Error Response

---
 changedetectionio/blueprint/rss/tag.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/changedetectionio/blueprint/rss/tag.py b/changedetectionio/blueprint/rss/tag.py
index 8459234ba..2fab8c060 100644
--- a/changedetectionio/blueprint/rss/tag.py
+++ b/changedetectionio/blueprint/rss/tag.py
@@ -7,7 +7,7 @@ def construct_tag_routes(rss_blueprint, datastore):
         datastore: The ChangeDetectionStore instance
     """
 
-    @rss_blueprint.route("/tag/<string:tag_uuid>", methods=['GET'])
+    @rss_blueprint.route("/tag/<uuid_str:tag_uuid>", methods=['GET'])
     def rss_tag_feed(tag_uuid):
 
         from flask import make_response, request, url_for