CVE-2026-41895
HighSummary
In versions 0.54.9 and earlier, changedetection.io switches to XML mode for XML/RSS content, leading to potential security issues related to processing untrusted XML data.
Risk Assessment
The failure to disable external entity resolution and DTD loading may lead to XML External Entity (XXE) attacks, jeopardizing the integrity and confidentiality of organizational data.
Recommendation
It is recommended to upgrade to the latest version of changedetection.io and implement appropriate safeguards to disable external entity resolution and DTD loading.
Other vulnerabilities in changedetection.io
See all- CVE-2026-43891High
In the changedetection.io web page change detection tool prior to version 0.55.1, a vulnerability exists due to trusting attacker-controlled snapshot paths restored from backup files. When a backup is restored, the application may restore malicious files, including history.txt, leading to the disclosure of local file contents.
- CVE-2026-71205Medium
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
- CVE-2026-71204Medium
In changedetection.io, the /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
- CVE-2026-71203Medium
In changedetection.io, REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec, whose get method carries neither @auth.check_token nor @validate_openapi_request.
- CVE-2026-35000Medium
A vulnerability in ChangeDetection.io before version 0.54.7 allows bypassing protections in the SafeXPath3Parser. Attackers can read arbitrary local files using unblocked XPath 3.0/3.1 functions like json-doc().
Original NVD description (English source)
changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).