CVE-2026-53511CWE-94code-injection

CVE-2026-53511

published July 8, 2026

CVSS
8.5
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
Not supplied
EPSS
0.00199 · 9.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-08T01:17Z
References (5)
https://github.com/kovidgoyal/calibre/commit/712f4e1ff5c1e798c335bef3bacc4efdee052e9c · [email protected]https://github.com/kovidgoyal/calibre/releases/tag/v9.10.0 · [email protected]https://github.com/kovidgoyal/calibre/security/advisories/GHSA-2j4m-2q7x-2c47 · [email protected]https://lists.debian.org/debian-lts-announce/2026/08/msg00034.html · af854a3a-2127-422b-91ae-364da2661108https://github.com/kovidgoyal/calibre/security/advisories/GHSA-2j4m-2q7x-2c47 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 JUL 20:46Z
    calibre: Arbitrary Code Execution in Template Formatter via Book Metadata
    cvelistv5