Which versions of calibre are affected by CVE-2026-53511?

Calibre, a popular open-source e-book manager, is vulnerable to arbitrary code execution through malicious e-book files that execute when imported or edited.. A patch is available.

How to fix or mitigate CVE-2026-53511?

Within 24 hours: inventory all calibre installations across the organization and notify users to avoid importing e-books from untrusted sources. Within 7 days: restrict calibre to trusted e-book sources only, and where possible disable custom metadata/column features that are not essential to operations. Within 30 days: establish a monitoring and rapid-deployment process for the vendor patch, targeting immediate deployment to all systems upon release.

calibre CVE-2026-53511

Q: What is the CVSS score of CVE-2026-53511?

CVE-2026-53511 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42102 HIGH

Code Injection (CWE-94)

2026-07-07 GitHub_M

RCE Python Code Injection Calibre Kovidgoyal

8.5

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

File must be processed locally (AV:L) and the victim must add/edit the book (UI:R); no privileges needed (PR:N) and exec() yields full C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:34 vuln.today

DescriptionCVE.org

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.

Articles & Coverage 1

News 3 New Python Vulnerabilities - 3 High Severity, No Public Exploits Jul 08, 2026

AnalysisAI

Arbitrary Python code execution in calibre (e-book manager) before 9.10.0 lets attackers run code on a victim's machine simply by having them import or edit a malicious EPUB, OPF, or PDF. The crafted file embeds a custom column definition containing a python: template inside the calibre:user_metadata field, which calibre passes unsanitized to exec() in its template formatter during routine metadata reading (Add books / Edit books). No public exploit has been identified at time of analysis, but the flaw triggers through normal user workflows, making weaponized e-book files a realistic delivery vector.

Technical ContextAI

calibre is a widely used cross-platform e-book library manager written in Python. It stores per-book custom column definitions as serialized metadata under the calibre:user_metadata key inside e-book files (EPUB/OPF) and PDFs. calibre's template formatter supports a 'python:' template mode intended for user-authored formatting logic, which is evaluated via Python's exec(). The vulnerability (CWE-94, Improper Control of Generation of Code / code injection) arises because metadata parsed from an untrusted, attacker-supplied file is treated as trusted template source and passed to exec() without sanitization or sandboxing. The only affected product per CPE is cpe:2.3:a:kovidgoyal:calibre:*:*:*:*:*:*:*:* across all versions prior to 9.10.0.

RemediationAI

Upgrade to calibre 9.10.0, the vendor-released patch, which stops untrusted python: templates from reaching exec() during metadata parsing (see advisory GHSA-2j4m-2q7x-2c47 and release v9.10.0 at https://github.com/kovidgoyal/calibre/releases/tag/v9.10.0). Until you can upgrade, do not add or edit e-books from untrusted or unverified sources, since metadata is evaluated automatically during Add books and Edit books; where feasible, process untrusted files inside an isolated/sandboxed environment or disposable VM to contain any code execution, accepting the workflow overhead. Organizations distributing e-books internally should validate or strip the calibre:user_metadata field from externally received files before importing them.