Description
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
wastemobile buildebooks
Default version status: unaffected
0 to < 0.2.2affected
pkg:npm/buildebooksReferences
- https://github.com/wastemobile/buildebooks/pull/12 ↗
- https://github.com/wastemobile/buildebooks/commit/123776c9ef61e8075ada2f7da2f7046f6a8078d9 ↗
- https://github.com/wastemobile/buildebooks/blob/7fc313485447d9359fb38fda3cbc2ed60ce69fe7/lib/kindle.js#L5-L12 ↗
- https://github.com/wastemobile/buildebooks ↗
- https://www.vulncheck.com/advisories/buildebooks-before-0.2.2-os-command-injection-via-kindlegen-epub-file-name ↗