CVE-2026-42601

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

State: Published
Severity: 9.3 Critical
Published: May 9, 2026
Updated: May 11, 2026
Reserved: Apr 29, 2026

Description

ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

Product	Versions
ArchiveBoxArchiveBox	<= 0.8.6rc0Affected

References

https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-3h23-7824-pj8r

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.