CVE-2026-42601 is a critical argument injection flaw (CVSS 9.8) in ArchiveBox 0.8.6rc0 and earlier. The /add/ endpoint merges an unchecked config field into the crawl settings, which can lead to remote code execution. The advisory lists no patched version, so restrict access now.
What's affected
The advisory lists ArchiveBox 0.8.6rc0 and prior, with patched versions listed as none at the time of writing. The NVD record says the same: no public patch at publication.
Exposure is much worse when the setting PUBLIC_ADD_VIEW is True, which the advisory says is common for bookmarklet use. In that mode the endpoint can be used without logging in. The endpoint is also exempt from CSRF checks.
How to check if you're exposed
- Run archivebox version and note the release.
- Check your configuration for PUBLIC_ADD_VIEW. If it is True, anonymous visitors can reach the endpoint.
- Find out how the instance is reachable. A box exposed to the internet, or to a large internal network, is at higher risk than one bound to a single trusted host.
- Look at your web server logs for POST requests to /add/ from addresses you do not know.
What to do now
- Set PUBLIC_ADD_VIEW to False so the endpoint needs a login.
- Put ArchiveBox behind a VPN, an authenticating reverse proxy or an IP allow list.
- Run it in a container with no access to secrets or internal services, as a low privilege user.
- Watch the ArchiveBox security advisory page for a patched release and upgrade when one appears.
- Review the host for unexpected processes and files if the instance was exposed to the internet.
Why it matters
The weakness is CWE-88, argument injection. User supplied JSON is merged into the crawl configuration, the configuration is exported to the environment when archive plugins run, and some plugins build command lines from those variables. A visitor can therefore choose extra arguments for tools such as the video downloader that ArchiveBox calls.
Handing an attacker control of the arguments to a command line tool is often as good as running code. The advisory ties this to no required login in the default bookmarklet setup. The KEV flag is false and the advisory does not claim exploitation.
Quick check
Is a fix available?
Not at the time of the advisory. It lists patched versions as none, so use the mitigations above and check the project for updates.
Sources
Last reviewed: 19 October 2026.
