This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-53511 →

DEBIAN-CVE-2026-53511

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calib...

Original description

The description as published by the source.

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 calibre

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.0+repack-2+deb12u10"}]}]

Debian:13 calibre

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 calibre

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0+ds+~0.10.6-1"}]}]

References

advisory security-tracker.debian.org