Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110637buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name

High 7.8

In plain English

A high-severity OS command injection in buildebooks from wastemobile. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)1.1%top 33.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.

Affected products (as reported)

Vendor	Product	Versions
wastemobile	buildebooks	0 – before 0.2.2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/wastemobile/buildebooks/pull/12 issue-tracking, patch
https://github.com/wastemobile/buildebooks/commit/123776c9ef61e8075ada2f7da2f7046f6a8078d9 patch
https://github.com/wastemobile/buildebooks/blob/7fc313485447d9359fb38fda3cbc2ed60ce69fe7/lib/kindle.js#L5-L12 technical-description
https://github.com/wastemobile/buildebooks product
VulnCheck Advisory: buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name third-party-advisory