MyBooks, an ebook management web server, allows an administrator to submit SOCIAL_AUTH key names without any sanitization of quotes or newline characters. The key names are written directly into a generated Python module (auto.py). An attacker who can reach the AdminSettings.post handler can craft a key name that closes the settings dictionary and injects arbitrary Python code. When the SettingsLoader loads the module, the injected code is executed with the privileges of the running service. As a result, a malicious actor can read, modify, or delete data; establish persistence; or cause denial of service. The weakness lies in improper code handling and injection of arbitrary code.

The vulnerability is present in PoxenStudio Talebook (MyBooks) version 3.41.2 and all earlier releases. It is fixed in version 3.42.0. The issue impacts the web server component that processes administrative settings and can be exploited only when an attacker has administrator privileges to submit the post request.

The CVSS score of 9.4 classifies this as critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability requires administrative access to the web server, but once achieved it provides full remote code execution. The environment can be abused through the auto.py import mechanism, which is automatically triggered when autoreload is enabled, causing a process supervisor to restart the service and execute the malicious module. The design flaw in handling untrusted input directly leads to a high exploitation probability for those with the necessary privileges.