Executive brief
Browsertrix is a browser-based web archiving and crawling tool used to capture and preserve website content. A vulnerability allows users with crawler or administrator privileges to execute arbitrary system commands on the server by submitting a malicious Git URL, potentially exposing or deleting archived data, credentials, and browser profiles stored in the application.
Technical details
The vulnerability is a command injection flaw in the custom behavior validation endpoint (/api/orgs/*/crawlconfigs/validate/custom-behavior) where Git URLs are not properly sanitized before being passed to system shell commands. An authenticated user with crawler or administrator role can craft a malicious Git URL containing shell metacharacters to execute arbitrary OS commands in the backend pod. The vulnerability affects versions 1.15.0 through 1.22.7; systems with open registration or free-trial access are at higher risk because the required role becomes broadly obtainable. The issue is resolved in version 1.22.8.
Affected products
- Webrecorder Browsertrix 1.15.0 to 1.22.7
Timeline
- 2026-09-17: disclosed: CVE-2026-54501 published
- 2026-05-22: patched: Fixed in version 1.22.8