CVE-2026-110637: buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running buildebooks versions before 0.2.2 are exposed when they build a book project that enables Kindle generation with "kindle: true". The commands execute with the privileges of the user running buildebooks.
What does an attacker need to exploit it?
An attacker needs to cause a user to process a crafted book project. The malicious input can be a front-matter filename or the project folder name, and exploitation requires the Kindle build path to be enabled.
Are projects affected by default?
The vulnerable command path is used when "kindle: true" is configured. The provided information does not indicate that Kindle generation is enabled by default.
What can be done if upgrading is not immediately possible?
Do not run affected versions on untrusted book projects, and avoid enabling "kindle: true" for projects whose filenames or folder names are not trusted. Run buildebooks with a low-privileged account to limit the impact of command execution.
How can I identify potentially affected builds?
Check whether the installed buildebooks version is earlier than 0.2.2 and whether projects are built with "kindle: true". Review project folder names and front-matter filenames for attacker-controlled or unexpected shell-command content.