CVE-2026-42601criticalCWE-88

CVE-2026-42601: falha crítica em ArchiveBox

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ArchiveBox+ Monitorar archivebox

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.4%
ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ArchiveBox · ArchiveBox
CVEs relacionadas — ArchiveBox

No mesmo produto, das mais perigosas para as menos.

CVE-2023-45815MEDIUMArchiveBox: Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins contextEPSS 0.8%