CVE-2026-110637
buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name
wastemobile buildebooks
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.15%Chance of exploitation activity in the next 30 days, higher than 66% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.2.2buildebooksCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.
Text from CVE List
Affected versions 1
- buildebooksaffected: all versions before 0.2.2CVE List
References 5
- github.com/wastemobile/buildebooks/pull/12Fixvia CVE List
- github.com/wastemobile/buildebooks/commit/123776c9ef61e8075ada2f7da2f7046f6a8078d9Fixvia CVE List
- vulncheck.com/advisories/buildebooks-before-0.2.2-os-command-injection-via-kindlegen-epub-file-nameAdvisoryvia CVE List
- github.com/wastemobile/buildebooks/blob/7fc313485447d9359fb38fda3cbc2ed60ce69fe7/lib/kindle.js#L5-L12Referencevia CVE List
- github.com/wastemobile/buildebooksReferencevia CVE List