CyberRota Analysis
AI-GeneratedCalibre versions prior to 9.10.0 are vulnerable to arbitrary code execution via malicious EPUB, OPF, or PDF files that exploit unsanitized metadata processing. Attackers can embed custom Python code in the metadata, which is executed when users add or edit books, potentially compromising user systems. Users and organizations utilizing Calibre for e-book management should prioritize upgrading to version 9.10.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.