CVE-2018-7889: Calibre-Ebook Calibre

High severity, CVSS 7.8. EPSS: 4.5% chance of exploitation in the next 30 days.

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.

Affected products

• Calibre-Ebook Calibre: version 3.18.0 only

Published 2018-03-08. Last modified 2026-06-17.