Vulnerability · Published May 12, 2026 · Assigned by GitHub_M

CVE-2026-41895changedetection.io: XXE vulnerability in the changedetection.io project

High 8.2

In plain English

A high-severity XML external entity in changedetection.io from dgtlmoon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.3%top 81.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	changedetection-io	no fix listed	GHSA-v7cp-2cx9-x793
PyPI	changedetection-io	0.54.10	PYSEC-2026-29

Affected products (as reported)

Vendor	Product	Versions
dgtlmoon	changedetection.io	<= 0.54.9

Weakness: CWE-611 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-v7cp-2cx9-x793 x_refsource_CONFIRM