CVE-2026-45272: CWE-94: Improper Control of Generation of Code ('Code Injection') in PoxenStudio talebook
Description
MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in webserver/loader.py concatenates those names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import. Successful exploitation executes commands with the privileges of the application service account and can disclose data, modify files, establish persistence, or disrupt the service. Related authorization and registration vulnerabilities can reduce the effective privilege requirement in a chained attack, but the standalone vulnerability requires administrator access. This issue is fixed in version 3.42.0.
CVSS v4.0
Score 9.4critical
Affected software
PoxenStudio
talebook
pkg:github/poxenstudio/mybooksRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Talebook versions 3.41.2 and earlier, the AdminSettings.post handler accepts SOCIAL_AUTH key names without validating or escaping quotes or newline characters. These key names are concatenated into the auto.py Python source file by SettingsLoader.dumpfile without escaping, allowing an administrator to inject arbitrary Python statements. The application executes these statements upon importing auto.py during service restart triggered by autoreload. This results in code execution with the application's service account privileges. The vulnerability requires administrator access and is fixed in version 3.42.0.
Potential Impact
Successful exploitation allows an attacker with administrator privileges to execute arbitrary Python code on the server running Talebook. This can lead to data disclosure, file modification, persistence establishment, or service disruption. Although related authorization and registration vulnerabilities may lower the privilege requirements in chained attacks, this vulnerability alone requires administrator access.
Mitigation Recommendations
This vulnerability is fixed in Talebook version 3.42.0. Users should upgrade to version 3.42.0 or later to remediate this issue. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed in vendor advisories but the description states the issue is fixed in 3.42.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-11T18:41:13.156Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a85c70aacd9273b493b3058
Added to database: 08/19/2026, 15:08:58 UTC
Last enriched: 08/19/2026, 15:25:14 UTC
Last updated: 10/04/2026, 10:02:27 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.