CVE-2026-73248
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Calibre before version 9.12.0 processes attacker-controlled composite_template metadata from malicious EPUB, OPF, PDF, or similar files through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
Risk Assessment
A user opening a malicious e-book file could allow arbitrary code execution on their machine, potentially leading to system compromise or data theft.
Recommendation
Update Calibre to version 9.12.0 or later. Avoid opening e-book files from untrusted sources.
Original NVD description (English source)
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.