Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-105080GHSA-M4HH-RQMF-C8HW

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Cali

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 0.19.0
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

Affected versions

  • C4illin ConvertX

    fixed in 0.19.0

References 3

GitHub · C4illin/ConvertX