CVE-2026-35000 dgtlmoon CVE debrief

Who should care

Users of ChangeDetection.io versions prior to 0.54.7 should update to version 0.54.7 or later to mitigate this vulnerability. This update is crucial for operators, platform administrators, vulnerability management teams, and security teams to prevent potential unauthorized access to sensitive data.

Technical summary

The vulnerability exists in the SafeXPath3Parser implementation of ChangeDetection.io versions prior to 0.54.7. An attacker can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. This could lead to unauthorized access to sensitive information.

Defensive priority

High

Recommended defensive actions

• Update ChangeDetection.io to version 0.54.7 or later
• Review and restrict access to sensitive data and local filesystem resources
• Monitor for suspicious activity and implement compensating controls as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-04-01T19:16:33.750Z and was last modified on 2026-07-14T19:17:03.830Z. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD details. Defenders should verify product deployments and review official advisories for affected scope and vendor guidance.

Official resources