The vulnerability in the JavaScript library of the e‑book building tool allows an attacker to inject operating‑system commands through the EPUB file name. When a book project is processed, the kindlegen executable is called via the Node.js child_process.exec function with the supplied file name, giving the attacker the ability to run arbitrary shell commands as the user executing the tool. The CVE description indicates the possibility of arbitrary command execution; this could lead to confidentiality, integrity, or availability impacts, but those specific consequences are inferred rather than explicitly stated. The vulnerability is rated with a CVSS score of 8.5.

Versions of the e‑book builder prior to 0.2.2, distributed by the vendor wastemobile under the product name buildebooks, are affected. Any deployment using these pre‑0.2.2 releases is vulnerable, regardless of platform, as the flaw resides in the core kindlegen module.

The exploit requires an attacker to create a maliciously named EPUB file or project folder, enable the kindle processing option, and then trigger the build. An EPSS score of 1% indicates a low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The high CVSS score of 8.5 indicates significant potential impact if exploited, resulting in OS command execution with the privileges of the buildebooks process owner.