CVE-2026-110637
CVE-2026-110637 · buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name
This page contains facts from public vulnerability sources. Check the original advisory before updating.
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.
CVSS 8.5 · High · EPSS 1.1% · Fix available
- Published
- Updated
Affected products and versions
buildebooks
- Versions
- ≥ 0, < 0.2.2: Affected (semver)
Update to 0.2.2
Original sources
- https://github.com/wastemobile/buildebooks/pull/12
- https://github.com/wastemobile/buildebooks/commit/123776c9ef61e8075ada2f7da2f7046f6a8078d9
- https://github.com/wastemobile/buildebooks/blob/7fc313485447d9359fb38fda3cbc2ed60ce69fe7/lib/kindle.js#L5-L12
- https://github.com/wastemobile/buildebooks
- https://www.vulncheck.com/advisories/buildebooks-before-0.2.2-os-command-injection-via-kindlegen-epub-file-name
- https://nvd.nist.gov/vuln/detail/CVE-2026-110637