CVE-2026-42601

Affected versions of the archivebox package are vulnerable to Remote Code Execution due to unvalidated merging of user-supplied per-crawl configuration overrides that are later exported as environment variables consumed by archive plugin command lines. The /add/ endpoint implemented by AddView in core/views.py extracts a config JSON field from the form at line 887 with no validation, merges it into the crawl config at line 918, and the merged values are exported as process environment variables in hooks.py lines 398 to 411, where plugins such as plugins/ytdlp/on_Snapshot__02_ytdlp.bg.py at lines 122 to 123 read variables like YTDLP_ARGS_EXTRA and append them directly to the yt-dlp argv. A remote attacker who reaches the @csrf_exempt /add/ endpoint, which is unauthenticated when PUBLIC_ADD_VIEW is true, can submit a config payload that injects arbitrary yt-dlp arguments such as --exec to execute attacker-chosen commands on the host.