—

PYSEC-2026-2131

Quick fix

PYSEC-2026-2131 — changedetection-io: upgrade to the fixed version with the command below.

pip install --upgrade 'changedetection-io>=0.54.7'

Details

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/changedetection-io

Introduced in: 0Fixed in: 0.54.7

Fixpip install --upgrade 'changedetection-io>=0.54.7'

References

https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7[ADVISORY]
https://github.com/dgtlmoon/changedetection.io/commit/dadc804567a51f803cd6715f7885c11a247915f6[FIX]
https://www.vulncheck.com/advisories/changedetection-io-safexpath3parser-bypass-arbitrary-file-read[FIX]