CVE-2026-73248: Calibre E-Book Manager RCE Vulnerability

CVE-2026-73248 Overview

Calibre is a widely used open-source e-book management application. Versions prior to 9.12.0 contain a code injection flaw ([CWE-94]) in the template formatter subsystem. Attackers can craft a malicious EPUB, OPF, PDF, or similar file containing composite_template metadata that abuses the program: construct with a nested template() call. The nested formatter fails to inherit the allow_python_templates=False policy, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported.

Critical Impact
Opening or importing a malicious e-book file into Calibre triggers arbitrary Python code execution in the context of the user running Calibre.

Affected Products

Calibre e-book manager, all versions prior to 9.12.0
File formats used as attack vectors: EPUB, OPF, PDF, and similar formats supporting metadata
Any workflow that opens or imports untrusted e-book files into Calibre

Discovery Timeline

2026-08-11 - CVE-2026-73248 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database
Version 9.12.0 - Calibre releases patched version resolving the issue

Technical Details for CVE-2026-73248

Vulnerability Analysis

The vulnerability resides in Calibre's template formatter, which supports a program: mode for advanced metadata computation. When a program: template invokes a nested template() function, Calibre instantiates a new formatter to evaluate the recursive template. The new formatter did not inherit the parent formatter's allow_python_templates policy. This gap allowed attacker-controlled metadata to include a python: template that reached compile_python_template and executed arbitrary Python code.

Because Calibre parses metadata automatically when files are opened, added to the library, or scanned, exploitation requires only that a user interact with a malicious file. The code runs with the privileges of the Calibre process, providing a path to full user-context compromise.

Root Cause

The root cause is missing policy propagation across recursive formatter instances in src/calibre/utils/formatter_functions.py. The nested formatter created inside the template() builtin defaulted to a permissive policy, bypassing the sandbox intended to block python: templates supplied through untrusted metadata.

Attack Vector

An attacker crafts an e-book file whose metadata includes a composite_template with a program: payload containing a nested template() call wrapping a python: block. When the victim opens or imports the file, Calibre parses the metadata, evaluates the recursive template, and executes the embedded Python code.

python

# Patch from src/calibre/utils/formatter_functions.py
# Recursive templates now inherit the python template policy
    def evaluate(self, formatter, kwargs, mi, locals, *args):
        (template,) = args
        template = template.replace('[[', '{').replace(']]', '}')
-       return formatter.__class__().safe_format(template, kwargs, 'TEMPLATE', mi)
+       new_formatter = formatter.__class__()
+       new_formatter.allow_python_templates = formatter.allow_python_templates
+       return new_formatter.safe_format(template, kwargs, 'TEMPLATE', mi)


class BuiltinEval(BuiltinFormatterFunction):

Source: Calibre patch commit dac9990

Detection Methods for CVE-2026-73248

Indicators of Compromise

E-book files (EPUB, OPF, PDF) whose metadata fields contain the substrings program:, template(, or python: in sequence
Unexpected child processes spawned by the Calibre process, such as shells, python, or network utilities
New or modified files under the user's Calibre library or home directory shortly after importing a new e-book
Outbound network connections initiated by Calibre to unfamiliar hosts following a file import

Detection Strategies

Inspect metadata blocks of incoming EPUB and OPF files for composite_template values containing nested template() and python: constructs
Monitor for Calibre spawning interpreter or shell processes, which is not part of normal library management
Alert on file writes to sensitive locations (SSH keys, startup folders, scheduled tasks) originating from the Calibre process tree

Monitoring Recommendations

Enable process-lineage telemetry on endpoints where Calibre is installed to capture parent-child relationships
Log and retain file-import events, including source path and metadata hashes, for forensic reconstruction
Correlate e-book import events with subsequent outbound network activity from the same process

How to Mitigate CVE-2026-73248

Immediate Actions Required

Upgrade Calibre to version 9.12.0 or later on all endpoints where it is installed
Do not open or import e-book files from untrusted sources until the upgrade is complete
Audit shared Calibre libraries for files added from external contributors and validate their metadata

Patch Information

The fix is included in Calibre 9.12.0. The patch modifies src/calibre/utils/formatter_functions.py so that recursive template evaluation inherits the parent formatter's allow_python_templates setting. See the GitHub Security Advisory GHSA-4f7g-rjfp-hmvx and the Calibre v9.12.0 release notes for details.

Workarounds

Restrict Calibre usage to trusted e-book sources until the upgrade is deployed
Run Calibre inside a low-privilege user account or sandbox (for example, Firejail, Windows Sandbox) to contain any code execution
Strip or normalize metadata from third-party e-book files using a separate tool before importing them into Calibre

bash

# Verify Calibre version on Linux/macOS
calibre --version

# Example: run Calibre in a Firejail sandbox with restricted network access
firejail --net=none --private-dev calibre