CVE-2026-73248CWE-94CWE-95code-injection

CVE-2026-73248

published August 12, 2026

CVSS
8.5
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
Not supplied
EPSS
0.00197 · 8.9th percentile
Weaknesses
CWE-94 · Improper Control of Generation of Code ('Code Injection'); CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-08-12T02:19Z
References (4)
https://github.com/kovidgoyal/calibre/commit/dac9990458374a81a5372a768bba6527d965aac8 · [email protected]https://github.com/kovidgoyal/calibre/releases/tag/v9.12.0 · [email protected]https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4f7g-rjfp-hmvx · [email protected]https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4f7g-rjfp-hmvx · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 AUG 21:56Z
    calibre: Bypass of Python template restrictions via nested `template()` leading to RCE
    cvelistv5