CVE-2026-42601 ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView
Attackers can achieve remote code execution in ArchiveBox by injecting arbitrary tool arguments via unvalidated per-crawl config overrides in the AddView endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42601?
CVE-2026-42601 is a critical command injection vulnerability in ArchiveBox, published on 9 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.
Weakness: CWE-88
Which versions are affected by CVE-2026-42601?
3 open source packages ship an affected version, including archivebox. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
archivebox PyPI | All versions to 0.8.6rc0 | None |
archivebox PyPI | All versions to 0.8.6rc0 | None |
archivebox PyPI | All versions to 0.8.6rc0 | None |
Products include Archivebox Archivebox.
How do I fix CVE-2026-42601?
No fix has been published for CVE-2026-42601 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-42601 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42601 exists.
Other vulnerabilities in ArchiveBox
Sources
Also known as GHSA-3h23-7824-pj8r, PYSEC-2026-283.