buildebooks CVE-2026-110637

Exploitation requires that the victim process an attacker-controlled buildebooks project with the Kindle output path enabled (kindle: true), which routes through lib/kindle.js and the kindlegen invocation. The concrete injection vector is the EPUB file name - specifically a malicious front-matter filename or project folder name - which pre-patch was concatenated into a shell command string passed to child_process.exec. Limiting factors: this is local/offline exploitation (AV:L) with required user interaction (UI:P) - the victim must actually run a build over the malicious project - and kindlegen/the Kindle build path must be in use; there is no remote or network-triggered path, and code executes only with the privileges of the user running buildebooks.

Signals are mostly consistent and point to a genuine-but-contained risk rather than a widespread emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) correctly describes a local, user-interaction-dependent flaw: the vendor-assigned 8.5 is driven by the full VC:H/VI:H/VA:H impact (arbitrary command execution) rather than by easy remote reach. There is no EPSS score in the input and the CVE is not in CISA KEV, so there is no public-scale exploitation signal; exploitation status is best described as no public exploit identified at time of analysis (no POC referenced, though the patch PR #12 reveals the exact injection point). The product (wastemobile/buildebooks) is an obscure Node.js ebook-build tool, which further lowers real-world priority despite the high impact score. Note a nuance: the vector is PR:N (so technically 'unauthenticated'), but exploitation is not remote - it requires the victim to locally build an attacker-supplied book project (UI:P), so treating this as a network-exploitable 8.5 would overstate the threat. Net: a real, confirmed code-execution bug worth patching for anyone using the tool on untrusted project input, but low aggregate risk given no exploitation evidence and a tiny deployment footprint.

An attacker publishes or shares a malicious buildebooks project whose front-matter filename or project-folder name embeds shell metacharacters (e.g. backticks or ';'). When a victim runs buildebooks with kindle: true, the crafted name is concatenated into a 'kindlegen <name>' string and passed to child_process.exec, executing the attacker's commands with the victim's privileges. No public exploit is identified, but the patch diff clearly exposes the vulnerable code path, making an exploit trivial to reconstruct.