CVE-2026-110637

Deferred Deferred - Pending Action

OS Command Injection in buildebooks via EPUB Filename

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110637

EUVD

EUVD-2026-101265

Affected Vendors & Products

Vendor	Product	Version / Range
wastemobile	buildebooks	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in buildebooks before version 0.2.2. It occurs in lib/kindle.js where a crafted EPUB file name passed to kindlegen via child_process.exec allows attackers to execute arbitrary OS commands. Attackers can create a malicious front-matter filename or project folder name with kindle: true to run commands as the user running buildebooks.

Detection Guidance

To detect this vulnerability, check if buildebooks version is below 0.2.2 by running: npm list -g buildebooks. If installed locally, use: npm list buildebooks. Also inspect lib/kindle.js for use of child_process.exec with string concatenation.

Impact Analysis

If exploited, this vulnerability allows attackers to run arbitrary commands on your system with the same privileges as the user running buildebooks. This could lead to data theft, system compromise, or further network infiltration. Users of affected versions should upgrade to 0.2.2 or later to mitigate the risk.

Compliance Impact

This vulnerability could lead to unauthorized command execution on systems processing EPUB files, potentially exposing sensitive data. For GDPR, it risks violating principles of data protection and integrity if personal data is accessed or altered. For HIPAA, it may compromise protected health information if the system handles medical records. Unauthorized command execution could also violate access control requirements in both standards.

Mitigation Strategies

Immediately upgrade buildebooks to version 0.2.2 or later using: npm install -g buildebooks@latest. Alternatively, remove Kindle-specific features if using version 0.3.0 or later since kindlegen is no longer supported.

Hi! I’m here to help you understand CVE-2026-110637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70