Description
changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dgtlmoon | changedetection.io | <= 0.54.9 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | changedetection-io | <= 0.54.9 | — | GHSA-v7cp-2cx9-x793 |
| PyPI | changedetection-io | < 0.54.10 | 0.54.10 | PYSEC-2026-29 |