CVE-2026-41895: 
Python vulnerability analysis and mitigation

CVE-2026-41895 is an XML External Entity (XXE) injection vulnerability in changedetection.io, an open-source web content change detection tool. The flaw exists in versions up to and including 0.54.9 (commit 9f3a9fdc18bba404244801e5df8109e213ce9ff4), specifically in the XML XPath helper functions located at changedetectionio/html_tools.py:287. It was disclosed by researchers FORIMOC and Yuremin, published to the GitHub Advisory Database on May 4, 2026, and assigned CVE-2026-41895. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory).

The root cause (CWE-611: Improper Restriction of XML External Entity Reference) lies in the xpath_filter() function, which switches to XML mode when processing XML/RSS content and instantiates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution (resolve_entities=False), external DTD loading (load_dtd=False), or network-backed entity lookup (no_network=True). The parser then calls etree.fromstring(...) on untrusted XML bytes fetched from monitored URLs, allowing external entity declarations in attacker-controlled XML to be expanded by lxml's default parser behavior. Exploitation requires that: (1) the attacker controls the XML/RSS response body of a watched URL, (2) the watch is configured with an XPath include filter triggering the XML helper path, (3) the runtime lxml configuration permits external entity expansion, and (4) the process has read access to the targeted local resource (GitHub Advisory, Security Advisory).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary local files accessible to the changedetection.io process, turning the watch processing pipeline into a local file disclosure primitive. Sensitive data exfiltrated via entity expansion can be embedded into extracted watch output, diff history, and downstream notification channels (e.g., email or webhook alerts), potentially exposing credentials, configuration files, or other confidential system data. There is no integrity or availability impact reported; the risk is confined to confidentiality loss (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation as of the time of this report (GitHub Advisory). The EPSS score is approximately 0.041% (15th percentile), indicating a low near-term probability of exploitation. No threat actor attribution has been made, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation does require specific preconditions — attacker control of a monitored URL's XML/RSS response and an XPath filter configured on the watch — which somewhat limits the attack surface.

1. Identify a target instance: Locate a changedetection.io deployment (version ≤ 0.54.9) that monitors external XML/RSS feeds and has XPath include filters configured on one or more watches.
2. Control the monitored XML/RSS endpoint: Set up or compromise a web server serving a malicious XML/RSS feed at a URL being watched by the target changedetection.io instance.
3. Craft a malicious XML payload: Construct an XML document with an external entity declaration referencing a sensitive local file on the server, for example:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<rss><channel><item><title>&xxe;</title></item></channel></rss>

4. Serve the payload: Host the malicious XML at the monitored URL so that changedetection.io fetches it during its next watch cycle.
5. Trigger XPath filter processing: Ensure the watch has an XPath include filter set, causing xpath_filter(..., is_xml=True) to be invoked, which passes the malicious XML to etree.fromstring(...) at html_tools.py:287.
6. Retrieve exfiltrated data: The contents of the referenced local file (e.g., /etc/passwd) are expanded into the watch output, diff history, or notification channels, which the attacker can then read via the changedetection.io UI or notification delivery (GitHub Advisory, Security Advisory).

• Network: Outbound HTTP/HTTPS requests from the changedetection.io process to unexpected external hosts during XML entity resolution; DNS lookups for attacker-controlled domains initiated by the lxml parser.
• Logs: Application logs showing watch processing of XML/RSS feeds with unusual or unexpected content; errors or warnings from lxml related to entity resolution or DTD loading.
• File System: Unexpected access to sensitive files (e.g., /etc/passwd, /etc/shadow, application config files) by the changedetection.io process, visible in OS-level audit logs (e.g., auditd or inotify events).
• Application Output: Watch diff history or notification payloads containing file contents that do not match expected XML/RSS feed data, particularly structured text resembling system files or configuration data (GitHub Advisory).

The GitHub Advisory notes that no patched version has been formally released as of the advisory publication date, though the issue was disclosed to the maintainer. The recommended remediation is to harden the XML parser construction in changedetectionio/html_tools.py by passing resolve_entities=False, load_dtd=False, and no_network=True to etree.XMLParser(), and to reject DOCTYPE/entity declarations for untrusted XML input. As a workaround, administrators should avoid configuring XPath include filters on watches that monitor untrusted or externally controlled XML/RSS feeds. Organizations should monitor the changedetection.io repository for a patched release and upgrade promptly when available (GitHub Advisory, Security Advisory).

The vulnerability was discovered and reported by security researchers FORIMOC and Yuremin, who provided a detailed source-to-sink analysis in their disclosure. The advisory was published by the maintainer (dgtlmoon) on April 27, 2026, and subsequently reviewed and added to the GitHub Advisory Database on May 4, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).