Read the docs
TI-2026-39347 Aliases CVE-2026-54501

Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors

Priority MEDIUM 45CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-250 and CWE-77.

Summary

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through /api/orgs/*/crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission on the specific instance can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod. Open registration or hosted free-trial access can make the required role broadly obtainable. Successful exploitation can expose, modify, or delete application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data. This issue is fixed in version 1.22.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01217 68th percentileScored 2026-11-07
Fix Fixed browsertrix (webrecorder): 1.22.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
webrecorderbrowsertrix1.15.0 to before 1.22.81.22.8Patch availableCNA
  • browsertrix Vendorwebrecorder Affected 1.15.0 to before 1.22.8 Fixed in 1.22.8 Patch available CNA

Remediation

  • Fix · CNA browsertrix (webrecorder) Fixed in 1.22.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54501

References

Other 3

  • TI-2025-36423 wabac.js has XSS vulnerability in 404 error handling logic CVSS 3.1HIGH 7.1
  • TI-2021-16663 Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences