ArchiveBox is an open source self-hosted web archiving system.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 9, 2026 · NIST NVD

   Detected

   ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are

2. Jul 24, 2026 · NIST NVD

   Updated

   ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are

Affected

• cpe archivebox/archiveboxversion unspecified
• cpe archivebox/archivebox0.8.6

Sources

• CVE.orgVulnerability recordCVE-2026-42601

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-42601

  ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables whe

  nvd.nist.gov

References

• Exploit · github.com