CVE-2026-54501: Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors

Q: Who can exploit this issue?

An attacker needs crawler or administrator permission on the affected Browsertrix instance. Where open registration or hosted free-trial access is available, obtaining the required role may be broadly possible.

Q: What access does successful exploitation provide?

A crafted Git URL can cause arbitrary operating-system commands to run in the backend pod. This can expose, modify, or delete application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data.

Q: Which versions need remediation?

Browsertrix versions from 1.15.0 up to, but not including, 1.22.8 are affected. Upgrade to version 1.22.8, which fixes the issue.

Published Sep 17, 2026

Updated

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through /api/orgs//crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission on the specific instance can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod. Open registration or hosted free-trial access can make the required role broadly obtainable. Successful exploitation can expose, modify, or delete application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data. This issue is fixed in version 1.22.8.

Affected Software

1 affected component

Webrecorder Browsertrix>1.15.0<=1.22.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Browsertrix to a version that resolves this vulnerability.
Fixed in 1.22.8
Compensating control
If you cannot immediately upgrade, restrict access to the endpoint /api/orgs/*/crawlconfigs/validate/custom-behavior and limit crawler/administrator permissions to only trusted users on the affected Browsertrix instances.

Event History

Sep 17, 2026

CVE Published

via MITRE·08:15 PM

Data Sourced

via MITRE·08:15 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs crawler or administrator permission on the affected Browsertrix instance. Where open registration or hosted free-trial access is available, obtaining the required role may be broadly possible.

What access does successful exploitation provide?