{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/buildebooks--0.2.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:buildebooks_project:buildebooks:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-110637"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["buildebooks (\u003c 0.2.2)"],"_cs_severities":["high"],"_cs_tags":["command-injection","supply-chain","nodejs"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe buildebooks package, prior to version 0.2.2, is susceptible to an OS command injection vulnerability located within the 'lib/kindle.js' file. This flaw originates from improper input sanitization when processing book project data. Specifically, when the 'kindle' configuration is set to true, the application passes user-supplied EPUB filenames or project folder names directly to the 'child_process.exec' function.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by creating a book project with a maliciously crafted filename containing shell metacharacters. When the library processes these names, it executes the injected commands within the context of the user running the build process. This vulnerability is significant as it provides a mechanism for remote code execution on systems where buildebooks is utilized to automate ebook generation. Defenders should prioritize updating to version 0.2.2 or later to eliminate the underlying command injection vector.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the user running the build process. This can lead to full system compromise, exfiltration of environment variables (such as CI/CD secrets), or the modification of the build pipeline to introduce persistent threats into downstream artifacts. The vulnerability affects all users running vulnerable versions of buildebooks in build environments, CI/CD pipelines, or desktop workstations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the buildebooks package to version 0.2.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit build logs and CI/CD pipelines for unusual process execution patterns initiated by the node runtime.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege by running build processes in isolated containers with minimal system permissions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:37:38Z","date_published":"2026-10-14T16:37:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-buildebooks-command-injection/","summary":"The buildebooks package before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute arbitrary system commands via crafted EPUB filenames.","title":"OS Command Injection in buildebooks","url":"https://feed.craftedsignal.io/briefs/2026-10-buildebooks-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Buildebooks (\u003c 0.2.2)","version":"https://jsonfeed.org/version/1.1"}