OS Command Injection in buildebooks

The buildebooks package, prior to version 0.2.2, is susceptible to an OS command injection vulnerability located within the 'lib/kindle.js' file. This flaw originates from improper input sanitization when processing book project data. Specifically, when the 'kindle' configuration is set to true, the application passes user-supplied EPUB filenames or project folder names directly to the 'child_process.exec' function.

An attacker can exploit this by creating a book project with a maliciously crafted filename containing shell metacharacters. When the library processes these names, it executes the injected commands within the context of the user running the build process. This vulnerability is significant as it provides a mechanism for remote code execution on systems where buildebooks is utilized to automate ebook generation. Defenders should prioritize updating to version 0.2.2 or later to eliminate the underlying command injection vector.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the user running the build process. This can lead to full system compromise, exfiltration of environment variables (such as CI/CD secrets), or the modification of the build pipeline to introduce persistent threats into downstream artifacts. The vulnerability affects all users running vulnerable versions of buildebooks in build environments, CI/CD pipelines, or desktop workstations.

Recommendation

• Upgrade the buildebooks package to version 0.2.2 or later immediately.
• Audit build logs and CI/CD pipelines for unusual process execution patterns initiated by the node runtime.
• Apply the principle of least privilege by running build processes in isolated containers with minimal system permissions.