Buildebooks
Monthly
OS command injection in buildebooks (wastemobile) versions before 0.2.2 lets a crafted EPUB file name or project folder name break out of the shell command string built in lib/kindle.js and execute arbitrary operating-system commands with the privileges of the user running the build. Exploitation is local rather than network-reachable: the victim must process an attacker-supplied book project with the Kindle output path enabled (kindle: true), which satisfies the user-interaction prerequisite, and no privileges are needed on the attacker's side per the assessed vector (PR:N). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, but the affected code path is straightforward (a naive string concatenation into child_process.exec) and a vendor fix is available in 0.2.2.
OS command injection in buildebooks (wastemobile) versions before 0.2.2 lets a crafted EPUB file name or project folder name break out of the shell command string built in lib/kindle.js and execute arbitrary operating-system commands with the privileges of the user running the build. Exploitation is local rather than network-reachable: the victim must process an attacker-supplied book project with the Kindle output path enabled (kindle: true), which satisfies the user-interaction prerequisite, and no privileges are needed on the attacker's side per the assessed vector (PR:N). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, but the affected code path is straightforward (a naive string concatenation into child_process.exec) and a vendor fix is available in 0.2.2.