CVE-2026-42601criticalCWE-88

CVE-2026-42601: critical vulnerability in ArchiveBox

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Published · Updated

Follow this CVE+ Monitor ArchiveBox+ Monitor archivebox

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.4%
ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
ArchiveBox · ArchiveBox
Related CVEs — ArchiveBox

In the same product, most dangerous first.

CVE-2023-45815MEDIUMArchiveBox: Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins contextEPSS 0.8%