CVE-2026-53511 Details
Description
calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.
A vulnerability in Calibre, an e-book management software, allows arbitrary execution of Python code through malicious EPUB, OPF, or PDF files. This issue affects Calibre versions prior to 9.10.0. The vulnerability arises when these files are processed, particularly during the 'Add books' or 'Edit books' functions. The malicious file can embed a custom column definition within the 'calibre:user_metadata' that includes executable Python code. This unsanitized data is then passed to the 'exec()' function via the template formatter, leading to code execution.
Users can upgrade to Calibre version 9.10.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kovidgoyal/calibre/security/advisories/GHSA-2j4m-2q7x-2c47 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://lists.debian.org/debian-lts-announce/2026/08/msg00034.html | CVE | |
| https://github.com/kovidgoyal/calibre/commit/712f4e1ff5c1e798c335bef3bacc4efdee052e9c | [email protected] | Source CodeVendor |
| https://github.com/kovidgoyal/calibre/releases/tag/v9.10.0 | [email protected] | Release NotesVendor |
| https://github.com/kovidgoyal/calibre/security/advisories/GHSA-2j4m-2q7x-2c47 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| calibre | <= 9.9.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | CVE Modified | CVE |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |