Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-42601 ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON fie… https://www.cve.org/CVERecord?id=CVE-2026-42601
Post summary
The CVE for ArchiveBox’s /add/ endpoint is disclosed with technical details but lacks mention of PoC, exploit code, or active attacks.
CVE-2026-42601 Remote Code Execution via Unvalidated Config Injection in ArchiveBox 0.8.6rc0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42601
Post summary
The text announces a Remote Code Execution vulnerability due to unvalidated configuration injection in ArchiveBox 0.8.6rc0, without detailing PoC, exploit, or mitigation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | archivebox | archivebox | - | - | - |
| App | archivebox | archivebox | 0.8.6 | - | - |