Unknown · Browsertrix · CVE-2026-54501
**Name of the Vulnerable Software and Affected Versions**
Browsertrix versions 1.15.0 through 1.22.7
**Description**
Improper sanitization of Git URLs specified as Custom Behaviors allows command injection via the '/api/orgs/*/crawlconfigs/validate/custom-behavior' endpoint. A user with crawler or administrator permissions can provide a crafted Git URL to execute arbitrary operating-system commands in the backend pod. This can lead to the exposure, modification, or deletion of application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data.
**Recommendations**
Update to version 1.22.8.