In ConvertX versions prior to 0.19.0, the converters/calibre.ts module fails to block recipe files and instead forwards them to the Calibre ebook-convert program. This behavior permits executable code contained within .recipe or .downloaded_recipe files to be executed, representing an inclusion of functionality from an untrusted control sphere (CWE-829). The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact metrics indicate high confidentiality, integrity, availability, and scope impacts.

The vulnerability allows an attacker to execute arbitrary code embedded in specially crafted .recipe or .downloaded_recipe files via the ebook-convert program. This can lead to full compromise of the affected system's confidentiality, integrity, and availability without requiring user interaction or elevated privileges. The critical CVSS score reflects the high potential impact of this flaw.

No official patch or remediation is currently documented for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, avoid processing untrusted .recipe or .downloaded_recipe files with ConvertX. Restrict usage to trusted inputs only.