CVE-2026-54501

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through /api/orgs/*/crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission on the specific instance can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod. Open registration or hosted free-trial access can make the required role broadly obtainable. Successful exploitation can expose, modify, or delete application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data. This issue is fixed in version 1.22.8.

• CWE-20
• CWE-77
• CWE-78
• CWE-88
• CWE-250

• https://github.com/webrecorder/browsertrix/commit/a306afc3893a74ed0ec2407bdf0515ed52da8e46
• https://github.com/webrecorder/browsertrix/releases/tag/v1.22.8
• https://github.com/webrecorder/browsertrix/security/advisories/GHSA-47vv-v544-r985

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54496ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…9.3
• CVE-2026-54497view_component is a framework for building reusable, testabl…6.8
• CVE-2026-54498view_component is a framework for building reusable, testabl…8.7
• CVE-2026-54499Stanza is a Stanford NLP Python library for tokenization, se…7.5
• CVE-2026-5450Calling the scanf family of functions with a %mc (malloc'd c…9.8
• CVE-2026-54500Oj (Optimized JSON) is a JSON parser and Object marshaller p…5.3
• CVE-2026-54502Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54503plone.app.textfield provides a zope.schema-style field type …4.3
• CVE-2026-54504MCP Documentation Server is a local-first document managemen…8.8
• CVE-2026-54505TREK is a collaborative travel planner. Prior to 3.1.0, when…2
• CVE-2026-54506Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-54507Vvveb is a powerful and easy to use CMS with page builder to…8.4