CyberRota Analysis
AI-GeneratedCalibre versions prior to 9.12.0 are vulnerable to arbitrary code execution due to improper handling of attacker-controlled composite_template metadata in malicious EPUB, OPF, or PDF files. This flaw allows a nested Python template to execute arbitrary Python code when the affected files are opened or imported, posing a significant security risk. Users and organizations utilizing Calibre for e-book management should prioritize upgrading to version 9.12.0 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.