CVE-2026-45272

Name of the Vulnerable Software and Affected Versions MyBooks versions prior to 3.42.0

Description The AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL AUTH key names without validating quotes or newline characters. Subsequently, SettingsLoader.dumpfile in webserver/loader.py concatenates these names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL AUTH key name to close the settings dictionary and inject arbitrary Python statements. These statements are executed when SettingsLoader.loadfile imports auto.py as a module, which occurs when autoreload is set to true and restart async is invoked. This allows for command execution with the privileges of the application service account, potentially leading to data disclosure, file modification, persistence, or service disruption.

Recommendations Update to version 3.42.0.