PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110637 wastemobile CVE debrief

CVE-2026-110637 debrief: buildebooks before 0.2.2 has a high-severity OS command injection vulnerability in lib/kindle.js, allowing attackers to execute commands via crafted EPUB file names passed to kindlegen. Defenders should assess exposure, prioritize verification and remediation, and monitor for suspicious activity. The vulnerability is in lib/kindle.js and allows attackers to execute OS commands as the user running buildebooks by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands.

Vendor
wastemobile
Product
buildebooks
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for systems and applications using buildebooks, especially those processing untrusted EPUB files, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-110637 is a high-severity OS command injection vulnerability in buildebooks before 0.2.2. Defenders should prioritize verifying and updating buildebooks versions, restricting untrusted EPUB file processing, and monitoring for suspicious activity.

  • Potential OS command execution as the user running buildebooks
  • Possible unauthorized access and data breaches
  • Required verification of buildebooks version and remediation to prevent exploitation

Technical summary

The buildebooks package before version 0.2.2 contains an OS command injection vulnerability in lib/kindle.js. This vulnerability allows attackers to execute OS commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. An attacker can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.

Defensive priority

Defenders should prioritize verifying and updating buildebooks versions to 0.2.2 or later, especially in environments where untrusted EPUB files are processed.

Recommended defensive actions

  • Verify buildebooks version and update to 0.2.2 or later
  • Review and restrict untrusted EPUB file processing
  • Monitor for suspicious activity in environments where buildebooks is used
  • Conduct a thorough review of buildebooks configurations and environments to identify potential exposure
  • Implement compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions and retest remediated assets to ensure the vulnerability is fully addressed
  • Review and update incident response plans to include procedures for handling potential exploitation of this vulnerability

Evidence notes

The CVE record and source item provide details on the OS command injection vulnerability in buildebooks before 0.2.2. The vulnerability is in lib/kindle.js and allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110637 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110637

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110637 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110637

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110637.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wastemobile/buildebooks/pull/12

    Supplemental source - issue-tracking, patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wastemobile/buildebooks/commit/123776c9ef61e8075ada2f7da2f7046f6a8078d9

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wastemobile/buildebooks/blob/7fc313485447d9359fb38fda3cbc2ed60ce69fe7/lib/kindle.js

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wastemobile/buildebooks

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/buildebooks-before-0.2.2-os-command-injection-via-kindlegen-epub-file-name

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.