Browsertrix CVE-2026-54501

Requires an authenticated account with crawler or administrator permission on the target Browsertrix org, and the ability to reach /api/orgs/*/crawlconfigs/validate/custom-behavior with a Custom Behaviors Git URL. Affected versions are 1.15.0 through 1.22.7 (fixed in 1.22.8). The key limiting factor is the role requirement (PR:L), but the advisory explicitly notes that open registration or hosted free-trial access can make that role broadly obtainable, materially lowering the barrier; no user interaction or non-default configuration is otherwise needed, and pre-fix the injected command ran without dropped privileges in the backend pod.

This is a genuine high-priority issue, not a CVSS-inflation artifact. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N with VC/VI/VA all High) is corroborated by the source-code diff: the pre-fix code built git ls-remote {repo_url} HEAD and passed it to asyncio.create_subprocess_shell, so attacker-controlled repo_url is interpolated directly into a shell command line - a textbook OS command injection (the CWE-20 label understates this; CWE-78 is the precise weakness). The fix replaces this with create_subprocess_exec (argument list, no shell) plus drop_privileges, confirming both the injection and that the process previously ran with elevated privileges in the backend pod. The main limiting factor is PR:L: the attacker needs crawler or administrator role on the instance, but the advisory notes open registration or hosted free-trial access can make that role broadly obtainable, effectively lowering the real-world barrier. No EPSS score, KEV listing, POC, or SSVC data was provided, so exploitation likelihood signals are absent - however the patch commit is public and the injection point is trivially reachable, so an exploit is easy to derive even without published code. Net: treat as a real priority for any self-hosted or hosted Browsertrix instance, especially those with open registration.

An attacker obtains a crawler or administrator role - potentially via open self-registration or a hosted free trial - then submits a crafted Git URL containing shell metacharacters to /api/orgs/*/crawlconfigs/validate/custom-behavior. The URL is interpolated into git ls-remote {repo_url} and executed by a shell in the backend pod, running arbitrary OS commands with the pod's privileges. No public POC was provided, but the fix commit makes the injection point and payload shape self-evident.