CVE-2026-45272 in Talebook
Summary
by MITRE • 08/19/2026
MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in webserver/loader.py concatenates those names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import. Successful exploitation executes commands with the privileges of the application service account and can disclose data, modify files, establish persistence, or disrupt the service. Related authorization and registration vulnerabilities can reduce the effective privilege requirement in a chained attack, but the standalone vulnerability requires administrator access. This issue is fixed in version 3.42.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The MyBooks application, also known as Talebook, serves as an enhanced personal ebook management web server designed for ease of use and efficient library organization. Within versions up to 3.41.2, a critical security flaw exists in the administrative configuration handling mechanisms that allows for remote code execution under specific conditions. The vulnerability resides primarily within the AdminSettings.post handler located in the webserver/handlers/admin.py module and the SettingsLoader.dumpfile function found in webserver/loader.py. These components are responsible for processing administrator-submitted settings, specifically those related to SOCIAL_AUTH configurations used for third-party authentication integrations such as OAuth providers. The core technical flaw is a lack of input validation regarding special characters within key names submitted by administrators. When an administrator provides a SOCIAL_AUTH key name containing unescaped quotes or newline characters, the application fails to sanitize these inputs before writing them into the generated Python source file named auto.py via the dumpfile function. This concatenation process does not escape the maliciously crafted strings, resulting in syntactically invalid but potentially exploitable Python code being written to disk.
The operational impact of this flaw is severe because it leads directly to arbitrary command execution on the host system running the MyBooks service. The vulnerability operates through a chain of events initiated by an administrator user. Once the malicious key name containing injected Python statements is saved, the application's configuration loading mechanism becomes the vector for exploitation. Specifically, when the SettingsLoader.loadfile function imports auto.py as a module to apply settings changes, it executes any valid Python code present within that file. Furthermore, if the autoreload feature is enabled in the MyBooks configuration, the system invokes restart_async which triggers a service restart via a process supervisor. This restart mechanism forces the re-import of the compromised auto.py module, thereby executing the injected commands with the privileges of the application service account. Consequently, an attacker who has obtained administrative access can execute arbitrary code on the server, leading to full compromise of the underlying operating system environment.
From a threat modeling perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code or Script, commonly referred to as injection flaws where user input is directly incorporated into executable code without proper sanitization. In terms of adversary behavior and detection frameworks such as MITRE ATT&CK, this exploitation technique maps closely to T1059 Command and Scripting Interpreter, specifically involving the execution of system commands through legitimate application processes. The ability to execute arbitrary statements allows for a wide range of malicious activities including data disclosure by reading sensitive files from the server filesystem, modification or deletion of critical configuration and database files, establishment of persistence mechanisms such as backdoors or scheduled tasks, and disruption of service availability through resource exhaustion or process termination. While standalone exploitation requires existing administrator privileges, related authorization flaws in registration processes could potentially reduce this privilege requirement if chained together with other vulnerabilities to escalate access from a standard user to an admin role.
Mitigation strategies for this vulnerability are straightforward but require immediate action due to the severity of the impact. The primary and most effective remediation is to upgrade MyBooks or Talebook to version 3.42.0 or later, where the developers have implemented proper input validation and escaping mechanisms in the AdminSettings.post handler and SettingsLoader.dumpfile functions. Until an upgrade can be performed, administrators should strictly limit access to administrative settings interfaces using robust network segmentation and strong authentication controls such as multi-factor authentication to prevent unauthorized users from reaching the vulnerable endpoints. Additionally, disabling the autoreload feature if it is not essential for development or debugging purposes can mitigate the automatic execution trigger, although this does not address the underlying injection flaw itself. Regular auditing of configuration files like auto.py for unexpected content and monitoring system logs for unusual process restarts or command executions are recommended defensive measures to detect potential exploitation attempts in environments where patching may be delayed.