calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4744 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4744-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     August 18, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : calibre     Version        : 6.13.0+repack-2+deb12u10     CVE ID         : CVE-2026-53511

    It was discovered that a malicious EPUB, OPF or PDF file can execute     arbitrary Python code when its metadata is read by calibre, an e-book     manager.

    There was a regression introduced by the fix of CVE-2026-25636. It is     also fixed in this update.

    For Debian 12 bookworm, this problem has been fixed in version     6.13.0+repack-2+deb12u10.

    We recommend that you upgrade your calibre packages.

    For the detailed security status of calibre please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/calibre

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6776f4e492 advisory.

    Fixes CVE-2026-53511

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-79a5573be3 advisory.

    Update to 9.11.0. Fixes rhbz#2493338 and CVE-2026-53511

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary     Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding     a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to     exec() in the template formatter. This issue is fixed in version 9.10.0. (CVE-2026-53511)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
337080	Debian dla-4744 : calibre - security update	Nessus	Debian Local Security Checks	Local	high
326718	Fedora 43 : calibre (2026-6776f4e492)	Nessus	Fedora Local Security Checks	Local	high
326571	Fedora 44 : calibre (2026-79a5573be3)	Nessus	Fedora Local Security Checks	Local	high
325781	Linux Distros Unpatched Vulnerability : CVE-2026-53511	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53511

high

Tenable Plugins

high

high

high

high