EUVD-2026-57014Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious EPUB with python: payload in composite_template metadata
-
DeliveryDeliver file to victim via download, email, or sharing
-
ExploitVictim opens or imports file in calibre < 9.12.0
-
ExecutionOuter program: formatter spawns child formatter without allow_python_templates=False
-
PersistChild formatter reaches compile_python_template
-
ImpactArbitrary Python executes as calibre process user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim open or import a file in calibre containing attacker-controlled composite_template metadata using a program: prefix with a nested template(), eval(), re_group(), or list_re_group() call embedding a python: sub-template. The affected file must be in a format calibre accepts for metadata processing (EPUB, OPF, PDF, or similar). No authentication, no elevated system privileges, and no special network configuration are required on the victim machine. Exploitation is constrained by: (1) the need for user interaction - the victim must open the file in calibre; (2) file delivery - the attacker must get the malicious file onto the victim's system. Python template processing is a core built-in feature enabled by default; there is no configuration setting to disable it without modifying calibre itself. |
| Impact | The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) is well-calibrated: the local attack vector correctly reflects that the malicious file must reach the victim's filesystem, and passive user interaction (opening or importing a file) is required. Despite these prerequisites, real-world risk is meaningful - calibre users routinely download and open untrusted e-books from the internet, making file-delivery a realistic social-engineering path. Attack complexity is low once the payload is embedded in a syntactically valid EPUB or OPF. No CISA KEV listing is present and no standalone POC has been publicly released, but the public patch diff effectively documents the exploit technique, reducing the reproduction barrier significantly. EPSS data is absent from the provided intelligence set and cannot be stated. The combination of passive user interaction as the only barrier, full VC/VI/VA impact, and a broadly used consumer-facing application makes this a genuine high-priority patch for any environment where calibre ingests untrusted content. |
| Exploit ScenarioDerived | An attacker distributes a crafted EPUB file - for example, via a torrent site, phishing email, or compromised e-book repository - with composite_template metadata set to program: template('python:\ndef evaluate(book, ctx): import subprocess; subprocess.run([...])'). When the victim opens or imports this file in calibre prior to 9.12.0, the metadata formatter spawns a child formatter without the allow_python_templates=False restriction, executing the embedded Python payload with the full privileges of the calibre process and the user running it. The public commit diff makes this attack pattern clear and reproducible without requiring independent vulnerability research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Arbitrary Python code execution in calibre's template engine affects all versions prior to 9.12.0, triggered when a user opens or imports a crafted EPUB, OPF, PDF, or OPF file containing malicious composite_template metadata. The root cause is a sandbox policy inheritance failure: nested formatter invocations via template(), eval(), re_group(), and list_re_group() instantiated fresh formatter objects without propagating allow_python_templates=False from the parent, allowing an embedded python: sub-template to bypass the restriction and reach compile_python_template. No public exploit has been identified at time of analysis, though the full patch diff is publicly visible on GitHub and makes the attack straightforward to reproduce.
RemediationAI
Upgrade calibre to version 9.12.0 or later, the vendor-confirmed fix release available at https://github.com/kovidgoyal/calibre/releases/tag/v9.12.0. The underlying patch (commit dac9990458374a81a5372a768bba6527d965aac8) ensures allow_python_templates is propagated to all child formatter instances. If immediate upgrade is not possible, avoid opening EPUB, OPF, PDF, or similar files from untrusted or unverified sources in calibre until the patch is applied - this is the only practical compensating control, as python template processing is a built-in feature with no independently configurable disable switch. Scanning incoming e-book files with antivirus tools will not reliably detect this attack since the payload is embedded as plain metadata text.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
calibre implements a custom template language for book metadata processing, supporting program: (GPM mode) and python: (direct Python execution via compile_python_template) prefixes. The allow_python_templates flag on SafeFormat and EvalFormatter instances is the primary sandbox control. The CWE-94 (Code Injection) root cause is that four formatter functions - template(), eval(), re_group(), and list_re_group() - each instantiated new child formatter objects using formatter.__class__() or EvalFormatter() without copying allow_python_templates from the parent formatter. The fix in commit dac9990 explicitly propagates this flag to every newly created child formatter. An attacker embeds program: template('python:\ndef evaluate(book, ctx): ...') in composite_template metadata within a supported file format; when calibre parses that metadata, the outer GPM formatter runs with Python templates blocked, but the child spawned by template() defaults to unrestricted, reaching arbitrary Python execution.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be opened locally (AV:L, UI:R); no privileges needed on target (PR:N); arbitrary Python execution yields full CIA impact with no scope change.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
Articles & Coverage 1
Executive ViewAI
Calibre users who open or import crafted documents face arbitrary Python code execution through a sandbox bypass vulnerability affecting all versions prior to 9.12.0, exposing systems to unauthorized code execution and potential data manipulation. While no public exploit code exists at time of analysis, the publicly available patch diff enables straightforward attack reproduction, creating urgent risk for organizations whose users import external content. The CVSS 8.5 severity and common document-handling workflows require immediate containment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict calibre file imports to pre-approved trusted document sources only; (2) Execute calibre in isolated or sandboxed environments with minimal system and network access; (3) Implement process-level and file system monitoring to detect unauthorized Python code execution via calibre processes; (4) Disable Python template processing features in calibre configuration if supported; (5) Enable comprehensive logging of all calibre import and processing operations for audit and anomaly detection; (6) Require mandatory user training emphasizing prohibition on opening documents from untrusted or unvalidated external sources within calibre.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB