PYSEC-2026-1235

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/calibreweb/PYSEC-2026-1235.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-1235

Aliases

Published

2026-07-07T16:02:58.532715Z

Modified

2026-07-07T17:47:24.599666352Z

Severity

5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Calibre Web and Autocaliweb have OS Command Injection vulnerability

Details

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

References

Affected packages

PyPI / calibreweb

Package

Name: calibreweb; View open source insights on deps.dev
Purl: pkg:pypi/calibreweb

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.6.24

Affected versions

0.*

0.6.12

0.6.13

0.6.14

0.6.15

0.6.16

0.6.17

0.6.18

0.6.19

0.6.20

0.6.21

0.6.22

0.6.23

0.6.24

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/calibreweb/PYSEC-2026-1235.yaml"