CVE-2026-35000None▾ SunlitChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc(…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.
changedetection-io < 0.54.7Upgrade to a patched release:
changedetection-io 0.54.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33981HighChangedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
CVE-2024-23329Low· 3.7changedetection.io API endpoint is not secured with API token
CVE-2024-32651Critical· 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CVE-2026-25527Medium· 5.3changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` ro…
CVE-2026-27645Medium· 6.1changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
CVE-2026-29038Medium· 6.1changedetection.io has Reflected XSS in its RSS Tag Error Response