CVE-2026-73248 PUBLISHED

calibre: Bypass of Python template restrictions via nested `template()` leading to RCE

Assigner: GitHub_M
Reserved: 11.08.2026 Published: 11.08.2026 Updated: 11.08.2026

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.5

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	kovidgoyal
Product	calibre
Versions	Version < 9.12.0 is affected

References

Problem Types

CWE-94: Improper Control of Generation of Code ('Code Injection') CWE
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') CWE