Vulnerability · Published May 9, 2026 · Assigned by GitHub_M

CVE-2026-42601ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Critical 9.3

In plain English

A critical-severity argument injection in ArchiveBox from ArchiveBox. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 65.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	archivebox	no fix listed	GHSA-3h23-7824-pj8r
PyPI	archivebox	no fix listed	PYSEC-2026-283

Affected products (as reported)

Vendor	Product	Versions
ArchiveBox	ArchiveBox	<= 0.8.6rc0

Weakness: CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-3h23-7824-pj8r x_refsource_CONFIRM