Which versions of ArchiveBox are affected by CVE-2026-42601?

ArchiveBox versions 0.8.6rc0 and earlier contain a critical remote code execution vulnerability in the public bookmark submission endpoint that allows unauthenticated attackers to execute arbitrary…

How to fix or mitigate CVE-2026-42601?

Within 24 hours: Immediately disable PUBLIC_ADD_VIEW feature in ArchiveBox configuration if currently enabled, or take the affected ArchiveBox instance offline. Within 7 days: Audit firewall and access logs for POST requests to /add/ endpoint from untrusted sources; review any archives created during the vulnerability window for malicious content. Within 30 days: Monitor vendor advisory channels for patch release; evaluate migration to patched version or alternative archival solutions when available.

ArchiveBox CVE-2026-42601

Q: What is the CVSS score of CVE-2026-42601?

CVE-2026-42601 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-05-04 https://github.com/ArchiveBox/ArchiveBox

GHSA-3h23-7824-pj8r

Python RCE

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 09, 2026 - 20:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 09, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

May 09, 2026 - 20:22 NVD

9.3 (CRITICAL)

Source Code Evidence Fetched

May 04, 2026 - 21:47 vuln.today

Analysis Generated

May 04, 2026 - 21:47 vuln.today

DescriptionGitHub Advisory

The /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE.

When PUBLIC_ADD_VIEW=True (common for bookmarklet usage), this is exploitable without authentication. The endpoint is also @csrf_exempt.

Affected code:

core/views.py:887 - user config extracted with no validation:

python

custom_config = form.cleaned_data.get("config") or {}

core/views.py:918 - merged into crawl config:

python

config.update(custom_config)

config/configset.py:255-256 - crawl config applied with high priority:

python

if crawl and hasattr(crawl, "config") and crawl.config:
    config.update(crawl.config)

hooks.py:398-411 - config exported as env vars:

python

for key, value in config.items():
    if key in SKIP_KEYS: continue
    env[key] = str(value)

plugins/ytdlp/on_Snapshot__02_ytdlp.bg.py:122-123 - env var args passed to yt-dlp:

python

ytdlp_args_extra = get_env_array("YTDLP_ARGS_EXTRA", [])
cmd.extend(ytdlp_args_extra)

PoC (pre-auth when PUBLIC_ADD_VIEW=True):

bash

curl -X POST http://localhost:8000/add/ \
  -d "url=https://www.youtube.com/watch?v=dQw4w9WgXcQ" \
  -d "depth=0" \
  -d "config={\"YTDLP_ARGS_EXTRA\": \"[\\\"--exec\\\", \\\"id > /tmp/pwned\\\"]\"}"

After the crawl runs, yt-dlp executes id > /tmp/pwned via its --exec flag.

Same approach works with GALLERYDL_ARGS_EXTRA (gallery-dl --exec), or overriding any *_BINARY key.

Impact: Remote code execution on the ArchiveBox server. Pre-auth when PUBLIC_ADD_VIEW=True.

AnalysisAI

Remote code execution in ArchiveBox <= 0.8.6rc0 allows unauthenticated attackers to execute arbitrary commands on the server via unvalidated config injection in the /add/ endpoint. When PUBLIC_ADD_VIEW=True (common for bookmarklet usage), attackers inject malicious environment variables through the config JSON parameter that propagate to archive plugins like yt-dlp and gallery-dl, enabling command execution via --exec flags. The endpoint lacks both input validation and CSRF protection. CVSS 9.3 (Critical) with network vector, low complexity, and no authentication required. Public proof-of-concept exploit exists demonstrating pre-authentication RCE. No vendor-released patch identified at time of analysis.

Technical ContextAI

ArchiveBox is a Python-based self-hosted web archiving tool that uses external archiving plugins (yt-dlp, gallery-dl, wget, chrome, etc.) to capture web content. The vulnerability stems from CWE-88 (Improper Neutralization of Argument Delimiters) where user-controlled configuration data flows through multiple processing layers without sanitization. The /add/ endpoint accepts a config JSON parameter that gets merged via Python dict.update() into the crawl configuration (core/views.py:918). This configuration is then exported as shell environment variables (hooks.py:398-411) and passed to subprocess-invoked archiving tools. The yt-dlp plugin specifically reads YTDLP_ARGS_EXTRA from environment variables and extends command arguments directly (plugins/ytdlp/on_Snapshot__02_ytdlp.bg.py:122-123). The @csrf_exempt decorator and optional PUBLIC_ADD_VIEW=True setting create a pre-authentication attack surface. The affected package is distributed via PyPI as archivebox, affecting versions through 0.8.6rc0.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation requires setting PUBLIC_ADD_VIEW=False in ArchiveBox configuration to eliminate unauthenticated attack surface, though this disables bookmarklet functionality and still leaves authenticated users as threat actors. Implement web application firewall rules to block POST requests to /add/ endpoint containing 'config' parameter with suspicious patterns like 'ARGS_EXTRA', '--exec', or '*_BINARY'. Network-level controls should restrict /add/ endpoint access to trusted IP ranges only. For deployments requiring PUBLIC_ADD_VIEW=True, deploy reverse proxy with request body inspection to reject config parameters entirely until patched version releases. Consider disabling yt-dlp and gallery-dl plugins if not essential (trade-off: loses video/gallery archiving capability). Do not expose ArchiveBox directly to internet without authentication until fix available. Monitor https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-3h23-7824-pj8r for patch release announcements. Audit existing crawl logs for suspicious config parameters in historical /add/ requests as potential compromise indicator.