{"id":"CVE-2026-35000","aliases":["PYSEC-2026-2131"],"title":"ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows …","summary":"ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc(…","severity":"none","vendor":"changedetection-io","product":"changedetection-io","ecosystem":"pip","affected":["changedetection-io < 0.54.7"],"patched":["changedetection-io 0.54.7"],"published":"2026-04-01","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-2131","references":[{"url":"https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7"},{"url":"https://github.com/dgtlmoon/changedetection.io/commit/dadc804567a51f803cd6715f7885c11a247915f6"},{"url":"https://www.vulncheck.com/advisories/changedetection-io-safexpath3parser-bypass-arbitrary-file-read"}],"tags":["osv","pip"],"epss":0.0047,"epssPercentile":0.37942,"ingestedAt":"2026-07-13T18:58:07.468Z","slug":"CVE-2026-35000","body":"## Overview\n\nChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.\n\n## Affected packages\n\n- `changedetection-io < 0.54.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `changedetection-io 0.54.7`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}