Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-45272— MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File

Quick assessment

Affected
PoxenStudio talebook
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MyBooks（又名 Talebook）是一款功能增强且易于使用的个人电子书管理 Web 服务器。在 3.41.2 及更早版本中， 中的 处理程序在接受 键名时，未对引号或换行字符进行验证；同时， 中的 在生成 Python 源文件 时，会直接将这些键名拼接进代码中，而未进行转义处理。攻击者（作为管理员）可以提交精心构造的 键名，以闭合设置字典并注入任意 Python 语句。由于 会将 作为模块导入，因此应用会在后续执行这些注入的语句；此外，当设置 为 true 时，会触发 ，从而导致进程管理器重启服务并引发模块导

CVSS 9.4 · Critical EPSS 0.37% · P30

Affected Version Matrix 1

VendorProduct Version RangeStatus
PoxenStudio talebook < 3.42.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-45272

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File
Source: CVE Program / CVE List V5
Vulnerability Description
MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in webserver/loader.py concatenates those names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import. Successful exploitation executes commands with the privileges of the application service account and can disclose data, modify files, establish persistence, or disrupt the service. Related authorization and registration vulnerabilities can reduce the effective privilege requirement in a chained attack, but the standalone vulnerability requires administrator access. This issue is fixed in version 3.42.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PoxenStudio talebook < 3.42.0 -

II. Public POCs for CVE-2026-45272

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 8873 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-45272

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-45272 (2)

Vendor Advisories for CVE-2026-45272 (1)

Same Patch Batch · PoxenStudio · 2026-08-19 · 3 CVEs total

CVE-2026-45273 8.7 HIGH MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint
CVE-2026-45274 6.9 MEDIUM MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforc

IV. Related Vulnerabilities

Same product: talebook
Same vendor: PoxenStudio
Same weakness: CWE-94

V. Comments for CVE-2026-45272

No comments yet

Leave a comment