CVE-2026-42601: ArchiveBox Remote Code Execution via Unvalidated Config Overrides
Summary
CVE-2026-42601: ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView. Affects archivebox versions < 0.8.6rc0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ArchiveBox is an open-source tool designed for saving web pages and managing bookmarks. It allows users to archive content from the web and provides various plugins for enhanced functionality. However, a critical vulnerability exists in its handling of configuration overrides, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the /add/ endpoint (AddView in core/views.py) that accepts a config JSON field without proper validation. This unvalidated input is merged into the crawl configuration, which is then exported as environment variables during the execution of archive plugins. If the PUBLIC_ADD_VIEW setting is enabled, this vulnerability can be exploited without authentication, allowing an attacker to inject arbitrary commands and achieve remote code execution (RCE). The affected code segments demonstrate how user-provided configurations are integrated into the system without checks, leading to potential exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, set the PUBLIC_ADD_VIEW environment variable to False to prevent unauthenticated access to the /add/ endpoint. This can be done by modifying your environment configuration as follows: 'export PUBLIC_ADD_VIEW=False'.
Conclusion
The vulnerability CVE-2026-42601 in ArchiveBox poses a significant risk due to its potential for remote code execution via unvalidated configuration overrides. It is crucial for users to update to the latest version of the package and implement the recommended workarounds to secure their installations.
See every vulnerability recorded for archivebox →
FAQ
The CVSS score for this vulnerability is 9.3, indicating a critical level of severity.
Yes, if the PUBLIC_ADD_VIEW setting is enabled, the vulnerability can be exploited without any authentication.
Exploitation of this vulnerability can lead to remote code execution on the ArchiveBox server, allowing attackers to run arbitrary commands.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, implement the workaround by setting PUBLIC_ADD_VIEW to False to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for archivebox.
