Product
The buildebooks package before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute arbitrary system commands via crafted EPUB filenames.