PT-2026-36977 · Unknown · Archivebox

Q1Uf3Ng

·

Published

2026-05-04

·

Updated

2026-05-10

·

CVE-2026-42601

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ArchiveBox (affected versions not specified)
Description The '/add/' endpoint (AddView in core/views.py) allows the injection of arbitrary configuration into crawl jobs because the config JSON field is merged without validation. This configuration is subsequently exported as environment variables when archive plugins run, enabling the injection of tool arguments to achieve remote code execution. When the PUBLIC ADD VIEW variable is set to True, this can be exploited without authentication, as the endpoint is also @csrf exempt (exempt from Cross-Site Request Forgery protection, a mechanism that prevents unauthorized commands from being transmitted from a user the web application trusts). Specifically, the config parameter can be used to override keys such as YTDLP ARGS EXTRA or GALLERYDL ARGS EXTRA to execute arbitrary commands via the --exec flag of the respective tools.
Recommendations As a temporary workaround, set PUBLIC ADD VIEW to False to prevent unauthenticated access to the '/add/' endpoint. Restrict the use of the config parameter in the '/add/' endpoint until a patch is available.

Exploit

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-42601
GHSA-3H23-7824-PJ8R

Affected Products

Archivebox