webrecorder vulnerabilities

Products

• @webrecorder/archivewebpage 1
• @webrecorder/wabac 1
• browsertrix 1
• pywb 1
• wabac.js 1

Latest webrecorder CVEs

Newest publication first

1. CVE-2026-54501 Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors

   Published 2026-09-17

   Critical·CVSS 9.4 EPSS 1.2%

   Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection th...

2. CVE-2025-58765 wabac.js has XSS vulnerability in 404 error handling logic

   Published 2025-09-09

   High·CVSS 7.1 EPSS 0.26%

   wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original request...

3. CVE-2021-39286 Cross-site scripting in pywb

   Published 2021-08-18

   Medium·CVSS 6.1 EPSS 0.70%

   Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.