ConvertX, a file conversion tool, contains a flaw in its converters/calibre.ts component that fails to block recipe files such as .recipe or .downloaded_recipe. These files are forwarded directly to Calibre’s ebook‑convert program, an executable that runs on the host. Because the application does not validate or sanitize the recipe content, an attacker can supply a crafted recipe file that contains arbitrary code to be executed by the Calibre command. This weakness corresponds to CWE‑829, where a program uses a dangerous function without proper validation, allowing arbitrary code execution.

The vulnerability exists in all installations of ConvertX prior to version 0.19.0, including any systems that reference the library or application binaries sourced from the GitHub repository C4illin/ConvertX. No product version list is specified beyond the release cutoff; any earlier build that incorporates the vulnerable converters/calibre.ts module is affected.

The CVSS score of 9.4 signals a high‑severity exploit scenario. Although the EPSS score is not available, the absence of mitigating controls suggests that anyone able to supply a malicious recipe file could trigger arbitrary code execution at the privileges of the ConvertX process. The likely attack vector is inferred from the vulnerability description, as the application accepts recipe files which could be supplied locally or over a network interface. The vulnerability is not listed in CISA’s KEV catalog, but the magnitude of the impact warrants immediate remediation.