CVE-2026-42601: ArchiveBox RCE Vulnerability

CVE-2026-42601 Overview

CVE-2026-42601 is a critical argument injection vulnerability in ArchiveBox, an open source self-hosted web archiving platform. The flaw exists in the /add/ endpoint handled by AddView in core/views.py. The endpoint accepts a config JSON field that is merged into the crawl configuration without validation. ArchiveBox then exports these values as environment variables when archive plugins execute, allowing attackers to inject arbitrary arguments into downstream tools and achieve remote code execution. All versions through 0.8.6rc0 are affected, and no patches were available at the time of publication.

Critical Impact
Unauthenticated network attackers can inject arbitrary tool arguments via the /add/ endpoint to obtain remote code execution on the ArchiveBox host.

Affected Products

ArchiveBox versions up to and including 0.8.6rc0
Self-hosted ArchiveBox deployments exposing the /add/ endpoint
Docker and bare-metal installations using vulnerable archive plugins

Discovery Timeline

2026-05-09 - CVE-2026-42601 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-42601

Vulnerability Analysis

The vulnerability is classified under [CWE-88] Improper Neutralization of Argument Delimiters in a Command, also known as argument injection. ArchiveBox accepts a user-controlled config JSON object on the /add/ route and merges it directly into the runtime crawl configuration. Those configuration values are subsequently exported as environment variables consumed by external archiving tools such as wget, curl, chrome, yt-dlp, and similar binaries invoked by plugins.

Because the merged config is not validated or sanitized, an attacker can supply values that contain extra command-line flags. When a plugin reads its options from the environment and passes them to the underlying binary, the injected flags are interpreted as legitimate arguments. Many of the supported archiving tools expose flags that write to arbitrary file paths or execute helper commands, which converts argument injection into reliable remote code execution.

Root Cause

The root cause is the absence of an allowlist or schema validation when merging client-supplied JSON into the crawl configuration. ArchiveBox treats the structure as trusted operator input even though the endpoint is reachable over the network without authentication in default deployments.

Attack Vector

An attacker sends an HTTP request to the /add/ endpoint with a crafted config field. Once a crawl is triggered, the malicious values flow into plugin environment variables. The plugins then invoke external binaries with attacker-controlled arguments, yielding code execution in the context of the ArchiveBox worker process.

No verified public proof-of-concept code is available. Refer to the ArchiveBox GitHub Security Advisory GHSA-3h23-7824-pj8r for the official technical writeup.

Detection Methods for CVE-2026-42601

Indicators of Compromise

Unexpected POST requests to the /add/ endpoint containing a config JSON body with command-line flag characters such as --, =, or shell metacharacters.
ArchiveBox worker processes spawning child binaries (wget, curl, chrome, yt-dlp) with arguments not present in the default configuration.
New or modified files written outside the ArchiveBox data/ directory by the archiving user account.

Detection Strategies

Inspect ArchiveBox application logs for /add/ submissions originating from untrusted networks or anonymous sessions.
Correlate HTTP request bodies with subsequent process executions to identify argument values that did not originate from the operator-defined configuration.
Alert on archive plugin processes that launch shells, network listeners, or write to system directories.

Monitoring Recommendations

Enable verbose logging on the reverse proxy fronting ArchiveBox and retain full request bodies for the /add/ route.
Monitor environment variable changes for ArchiveBox worker processes using endpoint telemetry.
Track outbound network connections from the ArchiveBox host to detect post-exploitation callbacks.

How to Mitigate CVE-2026-42601

Immediate Actions Required

Restrict access to the /add/ endpoint behind authentication and a trusted network boundary until a patched release is available.
Disable public submission features and require operator review for any new crawl requests.
Audit existing ArchiveBox configuration and snapshots for evidence of injected arguments or unauthorized output paths.

Patch Information

At the time of publication, no upstream patch is available. Monitor the ArchiveBox GitHub Security Advisory GHSA-3h23-7824-pj8r for release notes and apply the fixed version as soon as it ships.

Workarounds

Place ArchiveBox behind a reverse proxy that enforces authentication and IP allowlisting for the /add/ route.
Run ArchiveBox as an unprivileged user inside a hardened container with read-only filesystem mounts and no outbound shell access.
Strip or reject any client-supplied config field at the proxy layer using request body filtering rules.

bash

# Example nginx rule to block config submissions to /add/
location /add/ {
    if ($request_method = POST) {
        if ($request_body ~* "\"config\"\s*:") {
            return 403;
        }
    }
    auth_basic "ArchiveBox";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://archivebox_upstream;
}