buildebooks: OS command injection via kindlegen EPUB file name

Summary

buildebooks, a command-line tool that builds ebooks with Pandoc and kindlegen, passes EPUB file names and project folder names to a shell command without proper neutralisation. An attacker who provides a crafted book project with a malicious front-matter filename or folder name and kindle: true can execute OS commands as the user who runs buildebooks. The attack requires a victim to process the crafted project locally, so the risk is mainly for build hosts that handle untrusted manuscripts.

Affected

• buildebooks versions before 0.2.2 (affected range 0 to < 0.2.2)

Fixed in

• Fixed in buildebooks 0.2.2 (fix commit 123776c9ef61e8075ada2f7da2f7046f6a8078d9, PR #12, which switches to an argument-array call instead of a shell call)

Workaround

• Unknown. The vendor documents no workaround.
• Not a mitigation according to the PR: the absence of kindlegen.
• Recommended by us (not from the vendor): do not build projects from untrusted sources, do not use the Kindle output option (kindle: true) for them, and run builds in a sandboxed container or a low-privilege account.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No evidence of exploitation in the wild, no CISA KEV listing and no public exploit code found in our searches. This is not confirmed absence.
• EPSS about 1.1 percent (0.01146).

Our recommendation

• Inventory hosts with buildebooks installed (for example with npm ls -g buildebooks).
• Update to buildebooks 0.2.2 or later where the tool is used.
• Remove the package where it is not needed.
• Prioritise build hosts that process external or untrusted content, such as publishing workflows or CI pipelines that accept outside contributions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• buildebooks GitHub repository github.com
• lib/kindle.js at commit 7fc3134 github.com
• Fix commit 123776c9 github.com
• Pull request #12 (fix) github.com
• VulnCheck advisory www.vulncheck.com
• Vulners MEND record (EPSS) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:36.