ArchiveBox

🗃 Open source self-hosted web archiving. Takes URLs/browser history/bookmarks/Pocket/Pinboard/etc., saves HTML, JS, PDFs, media, and more...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2026-15307 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2026-15830 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

aether-sdk (>=1.3.4, <=1.3.8), apis-bibsonomy (>=0.2.0, <=0.3.0) +171 more potentially affected by CVE-2026-15307 via django (3.1.14)

django PYPI version 3.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aether-sdk =1.3.4, =0.2.0, =0.16.12, =0.8.8, =0.6.0, =0.0.1, =2.11.0, =0.1.1, =0.11.1, =0.1.1, =0.1.0, =0.3.12 and more Source cves: CVE-2026-15307...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-15830 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2026-15830 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-53878 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-48588 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-53877 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2026-53878 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2026-53877 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2024-45231 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2024-45231 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

The /add/ endpoint AddView in core/views.py accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE.When PUBLICADDVIEW=True commo...

PYSEC-2026-283 ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

The /add/ endpoint AddView in core/views.py accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. When PUBLICADDVIEW=True comm...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2026-48587 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2026-8404 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-48587 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

CVE-2026-42601

ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint AddView in core/views.py accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins...

CVE-2026-42601

ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint AddView in core/views.py accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins...