---
cve: "CVE-2026-42601"
severity: "CRITICAL"
cvss: 9.3
epss: "0.6%"
vendor: "ArchiveBox"
kev: false
exploited: false
published: "2026-05-09 20:16:29"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-23T18:04:45+02:00"
---

# CVE-2026-42601

> 9.3 CRITICAL · 🧪 PoC

## Beschreibung

ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-05-11 14:45:56
- CNA-CVSS: **9.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-88** — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
  The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

## Angriffsmuster (CAPEC)

- [CAPEC-41 — Using Meta-characters in E-mail Headers to Inject Malicious Payloads](https://capec.mitre.org/data/definitions/41.html) _(Severity: High)_
- [CAPEC-88 — OS Command Injection](https://capec.mitre.org/data/definitions/88.html) _(Severity: High)_
- [CAPEC-137 — Parameter Injection](https://capec.mitre.org/data/definitions/137.html) _(Severity: Medium)_
- [CAPEC-174 — Flash Parameter Injection](https://capec.mitre.org/data/definitions/174.html) _(Severity: Medium)_
- [CAPEC-460 — HTTP Parameter Pollution (HPP)](https://capec.mitre.org/data/definitions/460.html) _(Severity: Medium)_

## Referenzen

- <https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-3h23-7824-pj8r>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-42601/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_