An attacker can exploit this by creating a book project with a maliciously crafted filename containing shell metacharacters. When the library processes these names, it executes the injected commands within the context of the user running the build process. This vulnerability is significant as it provides a mechanism for remote code execution on systems where buildebooks is utilized to automate ebook generation. Defenders should prioritize updating to version 0.2.2 or later to eliminate the underlying command injection vector.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the user running the build process. This can lead to full system compromise, exfiltration of environment variables (such as CI/CD secrets), or the modification of the build pipeline to introduce persistent threats into downstream artifacts. The vulnerability affects all users running vulnerable versions of buildebooks in build environments, CI/CD pipelines, or desktop workstations.

Recommendation

• Upgrade the buildebooks package to version 0.2.2 or later immediately.
• Audit build logs and CI/CD pipelines for unusual process execution patterns initiated by the node runtime.
• Apply the principle of least privilege by running build processes in isolated containers with minimal system permissions.