ArchiveBox, an open‑source self‑hosted web archiving tool, contains a flaw in its AddView endpoint that accepts a configuration JSON without validation. The JSON is merged into the crawl configuration and exported as environment variables for archive plugins. An attacker can supply malicious configuration data to inject arbitrary tool arguments, resulting in Remote Code Execution. The weakness corresponds to CWE‑88, which describes the injection of untrusted data into environment variables leading to code execution.

The vulnerability affects ArchiveBox releases 0.8.6rc0 and older. Users running these versions on any platform that exposes the /add/ API endpoint are at risk. The software is deployed under many self‑hosted setups, so the attack surface is potentially wide.

With a CVSS score of 9.3, this flaw is considered critical. The exploit requires the ability to post a crafted JSON payload to the /add/ endpoint; no authentication requirement is documented, so the vulnerability might be exploitable by anyone who can reach the API, further increasing risk. The EPSS score is unavailable, and the vulnerability is not yet listed in CISA's KEV catalog, but the lack of a patch means the window for exploitation remains open. Administrators should treat this as a high‑priority issue, monitor for an official fix, and harden the endpoint.