CVE-2026-110637
CVE-2026-110637 · buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.
CVSS 8.5 · Alta · EPSS 1,1% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
buildebooks
- Versiones
- ≥ 0, < 0.2.2: Afectada (semver)
Actualiza a 0.2.2
Fuentes originales
- https://github.com/wastemobile/buildebooks/pull/12
- https://github.com/wastemobile/buildebooks/commit/123776c9ef61e8075ada2f7da2f7046f6a8078d9
- https://github.com/wastemobile/buildebooks/blob/7fc313485447d9359fb38fda3cbc2ed60ce69fe7/lib/kindle.js#L5-L12
- https://github.com/wastemobile/buildebooks
- https://www.vulncheck.com/advisories/buildebooks-before-0.2.2-os-command-injection-via-kindlegen-epub-file-name
- https://nvd.nist.gov/vuln/detail/CVE-2026-110637