Vulnerabilities

TI-2026-39347 CVE-2026-54501

Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors

MEDIUM 45

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.01217 Published 2026-09-17 Fixed in 1.22.8 CWE-20

TI-2025-36423 CVE-2025-58765 · GHSA-w765-jm6w-4hhj

wabac.js has XSS vulnerability in 404 error handling logic

LOW 31

wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00254 Published 2025-09-09 Fixed in 2.23.11, 2.3.17 +1 CWE-79

TI-2021-16663 CVE-2021-39286 · GHSA-947x-pv47-pp3q

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

LOW 28

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00699 Published 2021-08-18 Fixed in 2.6.0 CWE-79

Vulnerabilities

Filters

Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors

wabac.js has XSS vulnerability in 404 error handling logic

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.