calibre EUVD-2026-42102

Exploitation requires the victim to process an attacker-supplied EPUB, OPF, or PDF in calibre via the Add books or Edit books workflow, which triggers metadata reading; the file must embed a custom column definition containing a 'python:' template inside the calibre:user_metadata field. Limiting factors: the vulnerable path is local only (AV:L) - the attacker must first deliver a file and cannot trigger it purely remotely - and it depends on passive user interaction (UI:P), i.e. the user must add or edit the malicious book. No authentication or special privileges are needed (PR:N), default configurations are affected since metadata reading is standard behavior, and only calibre versions before 9.10.0 are exploitable.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, base 8.5 High) is internally consistent with the description: exploitation is local (the malicious file must be processed on the victim's system) and requires passive user interaction (adding or editing the book), but needs no privileges and grants full confidentiality, integrity, and availability impact via arbitrary code execution. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low-to-moderate today - this is a high-severity, socially-delivered RCE rather than a remotely-automatable mass-exploitation threat. The main risk driver is that metadata parsing happens automatically during import/edit, so no explicit 'run template' action is needed by the victim, lowering the effective interaction barrier. Priority should be elevated for environments that routinely ingest e-books from untrusted sources.

An attacker publishes an innocuous-looking e-book (EPUB/OPF/PDF) on a download site or emails it to a target, with a malicious python: template embedded in a custom column definition inside calibre:user_metadata. When the victim adds the file to their calibre library or opens it in Edit books, calibre reads the metadata and executes the embedded Python via exec(), running attacker code with the victim's privileges. No public POC has been identified, but the attack requires only that the victim import the file.