CVE-2026-110637

HIGH 7.8

buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.

CWE	CWE-78
Vendor	wastemobile
Product	buildebooks
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for wastemobile buildebooks

Be the first to know when new high vulnerabilities affecting wastemobile buildebooks are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

wastemobile / buildebooks

0 < 0.2.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/wastemobile/buildebooks/pull/12 github.com: https://github.com/wastemobile/buildebooks/commit/123776c9ef61e8075ada2f7da2f7046f6a8078d9 github.com: https://github.com/wastemobile/buildebooks/blob/7fc313485447d9359fb38fda3cbc2ed60ce69fe7/lib/kindle.js#L5-L12 github.com: https://github.com/wastemobile/buildebooks vulncheck.com: https://www.vulncheck.com/advisories/buildebooks-before-0.2.2-os-command-injection-via-kindlegen-epub-file-name

Credits

Zachariah Mithani