---
id: CVE-2026-35000
aliases:
  - PYSEC-2026-2131
title: >-
  ChangeDetection.io versions prior to 0.54.7 contain a protection bypass
  vulnerability in the SafeXPath3Parser implementation that allows …
summary: >-
  ChangeDetection.io versions prior to 0.54.7 contain a protection bypass
  vulnerability in the SafeXPath3Parser implementation that allows attackers to
  read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as
  json-doc(…
severity: none
vendor: changedetection-io
product: changedetection-io
ecosystem: pip
affected:
  - changedetection-io < 0.54.7
patched:
  - changedetection-io 0.54.7
published: '2026-04-01'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-2131'
references:
  - url: 'https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7'
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/commit/dadc804567a51f803cd6715f7885c11a247915f6
  - url: >-
      https://www.vulncheck.com/advisories/changedetection-io-safexpath3parser-bypass-arbitrary-file-read
tags:
  - osv
  - pip
epss: 0.0047
epssPercentile: 0.38031
ingestedAt: '2026-07-13T18:58:07.468Z'
---

## Overview

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

## Affected packages

- `changedetection-io < 0.54.7`

## Remediation

Upgrade to a patched release:

- `changedetection-io 0.54.7`