GHSA-qc4j-v7h6-xr5h

Source

https://github.com/advisories/GHSA-qc4j-v7h6-xr5h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-qc4j-v7h6-xr5h/GHSA-qc4j-v7h6-xr5h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qc4j-v7h6-xr5h

Aliases

Published

2025-07-24T21:30:39Z

Modified

2026-07-07T17:56:50Z

Severity

5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Calibre Web and Autocaliweb have OS Command Injection vulnerability

Details

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

Database specific

{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-07-25T20:19:12Z",
    "nvd_published_at":  "2025-07-24T21:15:52Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / calibreweb

Package

Name: calibreweb; View open source insights on deps.dev
Purl: pkg:pypi/calibreweb

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.6.24

Affected versions

0.*

0.6.12

0.6.13

0.6.14

0.6.15

0.6.16

0.6.17

0.6.18

0.6.19

0.6.20

0.6.21

0.6.22

0.6.23

0.6.24

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-qc4j-v7h6-xr5h/GHSA-qc4j-v7h6-xr5h.json"