Quick answers
- Is CVE-2026-53511 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-53511 being exploited in the wild.
- How severe is CVE-2026-53511?
- Informational severity, with a CVSS score of 8.5, published 7 July 2026.
- Which products and versions are affected?
- Kovid Goyal Calibre < 9.10.0.
- Is there a fix for CVE-2026-53511?
- A patch was published on 2026-06-26: Version 9.10.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-53511 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-53511?
- Check whether you run Kovid Goyal Calibre at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A code injection vulnerability exists in Calibre's template formatter prior to version 9.10.0. The root cause is the unsanitized processing of 'calibre:user_metadata' within EPUB, OPF, or PDF files. When Calibre reads metadata (e.g., during 'Add books' or 'Edit books' operations), it parses custom column definitions via json.loads() and stores them. If a composite custom column contains a 'python:' template, it is passed to the template formatter's safe_format() method, which eventually reaches exec() via compile_python_template(). An attacker can exploit this by providing a malicious e-book file that, when imported or edited, executes arbitrary Python code with the privileges of the Calibre process. The fix involves disallowing Python templates when reading book metadata.
Affected products
- kovidgoyal calibre < 9.10.0
Timeline
- 2026-06-26: patched: Version 9.10.0 released
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE-2026-53511 published to NVD