CVE-2026-53511 calibre: Arbitrary Code Execution in Template Formatter via Book Metadata
Attackers can execute arbitrary Python code by tricking users into opening malicious e-book files with crafted metadata in calibre.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53511?
CVE-2026-53511 is a high-severity code injection vulnerability in kovidgoyal calibre, published on 7 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.
Weakness: CWE-94
Which versions are affected by CVE-2026-53511?
Linux distribution packages (1)
calibre openSUSE:Tumbleweed | All versions | 9.10.0-1.1 |
How do I fix CVE-2026-53511?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-53511 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53511 exists.
Sources
Also known as DEBIAN-CVE-2026-53511, GHSA-2j4m-2q7x-2c47, UBUNTU-CVE-2026-53511, openSUSE-SU-2026:11130-1.