In Talebook versions 3.41.2 and earlier, the AdminSettings.post handler accepts SOCIAL_AUTH key names without validating or escaping quotes or newline characters. These key names are concatenated into the auto.py Python source file by SettingsLoader.dumpfile without escaping, allowing an administrator to inject arbitrary Python statements. The application executes these statements upon importing auto.py during service restart triggered by autoreload. This results in code execution with the application's service account privileges. The vulnerability requires administrator access and is fixed in version 3.42.0.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary Python code on the server running Talebook. This can lead to data disclosure, file modification, persistence establishment, or service disruption. Although related authorization and registration vulnerabilities may lower the privilege requirements in chained attacks, this vulnerability alone requires administrator access.

This vulnerability is fixed in Talebook version 3.42.0. Users should upgrade to version 3.42.0 or later to remediate this issue. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed in vendor advisories but the description states the issue is fixed in 3.42.0.