CVE-2026-45272: MyBooks (Talebook) RCE Vulnerability

CVE-2026-45272 Overview

CVE-2026-45272 is a code injection vulnerability [CWE-94] in MyBooks (also known as Talebook), a personal ebook management web server. The flaw affects versions 3.41.2 and earlier. The AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters. The SettingsLoader.dumpfile function in webserver/loader.py then concatenates those names into the generated auto.py source file without escaping. An authenticated administrator can inject arbitrary Python statements that execute when the service reloads. The issue is fixed in version 3.42.0.

Critical Impact
Successful exploitation executes arbitrary commands with the privileges of the application service account, enabling data disclosure, file modification, persistence, or service disruption.

Affected Products

MyBooks (Talebook) versions 3.41.2 and earlier
MyBooks (Talebook) deployments using the AdminSettings endpoint
Fixed in MyBooks (Talebook) version 3.42.0

Discovery Timeline

2026-08-19 - CVE-2026-45272 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-45272

Vulnerability Analysis

The vulnerability resides in the administrative settings workflow of MyBooks. When an administrator submits configuration data, the AdminSettings.post handler in webserver/handlers/admin.py accepts arbitrary SOCIAL_AUTH key names. These names are passed to SettingsLoader.dumpfile in webserver/loader.py, which writes them directly into the generated Python module auto.py.

Because the key names are concatenated into Python source without escaping quotes or newline characters, a crafted key name can terminate the settings dictionary and append arbitrary Python statements. The application then invokes SettingsLoader.loadfile, which imports auto.py as a module. When the administrator sets autoreload to true, the restart_async routine triggers a process supervisor restart, causing the injected code to execute during import.

Root Cause

The root cause is unsafe code generation. User-controlled input is embedded into a Python source file without input validation or output encoding. The application trusts administrator-supplied configuration names as syntactically safe identifiers, which they are not.

Attack Vector

An attacker with administrator privileges submits a SOCIAL_AUTH key name containing quote characters and newlines to break out of the string context. Related authorization and registration flaws referenced in the advisory can lower the effective privilege requirement in chained attacks. Once autoreload triggers the service restart, the injected Python statements run under the service account.

python

     @js
     @auth
     def post(self):
+        if not self.admin_user:
+            return {"err": "permission.not_admin", "msg": _("当前用户非管理员")}
+
         data = tornado.escape.json_decode(self.request.body)
         KEYS = [
             "ALLOW_GUEST_DOWNLOAD",

Source: GitHub Commit a1780c9 — the patch adds an explicit admin_user check to AdminSettings.post before processing settings data.

Detection Methods for CVE-2026-45272

Indicators of Compromise

Unexpected modifications to auto.py within the MyBooks installation directory, particularly containing quote characters, newlines, or Python statements outside expected dictionary syntax.
Service restarts triggered by restart_async shortly after administrative settings updates.
Outbound network connections or child processes spawned by the MyBooks service account without corresponding user activity.

Detection Strategies

Monitor writes to webserver/ generated files and compare their contents against a known-good baseline.
Alert on POST requests to the admin settings endpoint that include SOCIAL_AUTH key names containing non-alphanumeric characters, quotes, or line breaks.
Correlate administrative configuration changes with process restarts and subsequent shell or interpreter execution under the service account.

Monitoring Recommendations

Log all administrator authentication events and settings changes for MyBooks with immutable retention.
Track process lineage from the MyBooks service to detect anomalous child processes such as shells, curl, or wget.
Enable file integrity monitoring on the MyBooks application directory to detect unauthorized modifications to generated Python files.

How to Mitigate CVE-2026-45272

Immediate Actions Required

Upgrade MyBooks (Talebook) to version 3.42.0 or later, which validates key names and hardens the settings handler.
Audit the administrator account list and rotate credentials for any accounts that accessed the settings endpoint on vulnerable versions.
Review the contents of auto.py on all deployments for signs of injected Python statements.

Patch Information

The fix is available in MyBooks (Talebook) version 3.42.0. See the GitHub Release 3.42.0, the GitHub Security Advisory GHSA-4wfr-9gcv-j638, and the remediation commit a1780c9. The patch adds an explicit admin_user check to the settings handler and enforces active-account validation in the authentication path.

Workarounds

Restrict network access to the MyBooks administrative interface using firewall rules or a reverse proxy allowlist until patching is complete.
Disable the autoreload setting to prevent process supervisor restarts from importing a tampered auto.py.
Run the MyBooks service under a least-privilege account with no shell access and restricted filesystem permissions to limit the impact of code execution.

bash

# Verify the installed MyBooks version and upgrade
pip show mybooks | grep -i version
pip install --upgrade mybooks==3.42.0

# Restrict admin endpoint access at the reverse proxy layer
# nginx example:
#   location /api/admin/settings {
#       allow 10.0.0.0/8;
#       deny all;
#       proxy_pass http://mybooks_upstream;
#   }