CVE-2026-110637: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in wastemobile buildebooks

CVE-2026-110637 is an OS command injection vulnerability in the wastemobile buildebooks project affecting versions prior to 0.2.2. The vulnerability exists in lib/kindle.js where user-controlled input (EPUB file name) is passed to the kindlegen command using child_process.exec without proper sanitization. An attacker can exploit this by creating a malicious book project with a specially crafted front-matter filename or project folder name and enabling kindle: true, resulting in arbitrary OS command execution with the privileges of the buildebooks process.

Successful exploitation allows an attacker to execute arbitrary operating system commands as the user running buildebooks. This can lead to unauthorized actions on the host system, potentially compromising system integrity and confidentiality. The CVSS 4.0 base score is 8.5 (high severity), reflecting the significant impact and ease of exploitation given user interaction.

A fixed version 0.2.2 or later should be used to remediate this vulnerability. Users should upgrade buildebooks to version 0.2.2 or above where this issue is resolved. Until patched, avoid processing untrusted EPUB files or book projects with untrusted filenames or folder names, especially when kindle: true is enabled.