Executive brief
ArchiveBox is an open-source tool used to save and archive copies of websites. A security flaw allows unauthorized users to inject malicious commands into the system's archiving process. If exploited, an attacker could take full control of the server hosting the ArchiveBox instance, potentially leading to data theft or the disruption of archiving operations.
Technical details
An argument injection vulnerability exists in ArchiveBox's /add/ endpoint (AddView in core/views.py). The application accepts a 'config' JSON field from user input and merges it into the crawl configuration without validation. These configuration values are subsequently exported as environment variables when archive plugins (such as yt-dlp or gallery-dl) are executed. An attacker can provide malicious tool arguments (e.g., YTDLP_ARGS_EXTRA) or override binary paths to achieve arbitrary remote code execution (RCE). When PUBLIC_ADD_VIEW is enabled, this endpoint is accessible without authentication and is notably exempt from CSRF protection. As of publication, no official patch is available.
Affected products
- ArchiveBox ArchiveBox <= 0.8.6rc0
Timeline
- 2026-04-23: advisory: GitHub Security Advisory published
- 2026-05-09: disclosed: CVE-2026-42601 published