Cyber Resilience

CVE-2026-42601

CriticalPublic PoC

Published: 09 May 2026

Published
09 May 2026
Modified
14 May 2026
KEV Added
—
Patch
—
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0040 32.3th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-42601 is a critical-severity Argument Injection (CWE-88) vulnerability in Archivebox Archivebox. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment…

more

variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.

CWE(s)
CWE-88

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct exploitation of unauthenticated /add/ endpoint in public-facing ArchiveBox web app via unsanitized config injection (CWE-88) to achieve RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

archivebox
archivebox
0.8.6 · ≤ 0.8.6

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References