calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.
2.33.0+dfsg-1build12.38.0+dfsg-12.45.0+dfsg-12.45.0+dfsg-1build12.48.0+dfsg-12.48.0+dfsg-1build12.54.0+dfsg-12.55.0+dfsg-12.55.0+dfsg-1ubuntu0.23.12.0+dfsg-13.13.0+dfsg-13.14.0+dfsg-13.15.0.1+dfsg-13.16.0+dfsg-13.16.0+dfsg-1build13.17.0+dfsg-13.17.0+dfsg-23.18.0+dfsg-1build13.19.0+dfsg-1+5 more3.46.0+dfsg-14.2.0+dfsg-24.3.0+dfsg-14.3.0+dfsg-24.4.0+dfsg-14.5.0+dfsg-14.5.0+dfsg-24.5.0+dfsg-34.6.0+dfsg-14.7.0+dfsg-1+9 more7.26.0+ds-4build18.3.0+ds-18.4.0+ds-18.5.0+ds-18.6.0+ds-18.7.0+ds-18.8.0+ds-28.8.0+ds-38.8.0+ds-3build1Exploitability
AV:LAC:LAT:NPR:NUI:PVulnerable System
VC:HVI:HVA:HSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N