While analyzing the code logic, it was determined that an area may lead to unintended behavior under specific conditions. With the project's security in mind, see the analysis results to discern whether this may indicate a potential security risk.
0.54.9 (9f3a9fdc18bba404244801e5df8109e213ce9ff4)XXEXML XPath helpers parse untrusted XML with entity resolution left to lxml defaultschangedetectionio/html_tools.py:287xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).
xpath_filter(..., is_xml=True).xpath_filter() builds the default XML parser and calls etree.fromstring(...) at changedetectionio/html_tools.py:287.The XML helper path can turn watch processing into a local file disclosure primitive when entity expansion is enabled by parser defaults.
Sensitive local files can be exposed into extracted watch output, diff history, and...
Exploitability
AV:NAC:HAT:PPR:NUI:NVulnerable System
VC:HVI:NVA:NSubsequent System
SC:NSI:NSA:N8.2/CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N