Read the docs
TI-2021-02885 Aliases CVE-2021-3988GHSA-r735-9gc6-2hvq

Cross-site Scripting (XSS) in janeczku/calibre-web

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed calibreweb (PyPI): 0.6.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
janeczkujaneczku/calibre-webup to latest—No fix listedCNA
—calibreweb (PyPI)before 0.6.150.6.15Patch availableGHSA-r735-9gc6-2hvq
  • janeczku/calibre-web Vendorjaneczku Affected up to latest Fixed in — No fix listed CNA
  • calibreweb (PyPI) Vendor— Affected before 0.6.15 Fixed in 0.6.15 Patch available GHSA-r735-9gc6-2hvq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*before 0.6.15Vulnerablejaneczku
  • cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:* Versions before 0.6.15 Vulnerable ·janeczku

Remediation

  • Fix · GHSA-r735-9gc6-2hvq calibreweb (PyPI) Fixed in 0.6.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3988
  2. 2026-10-03 Alias added: GHSA-r735-9gc6-2hvq

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2023-01981 Weak Password Requirements in janeczku/calibre-web CVSS 3.1CRITICAL 9.8
  • TI-2022-02333 Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web CVSS 3.1CRITICAL 9.8
  • TI-2021-07971 Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2025-06745 Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C CVSS 4.0MEDIUM 5.9
  • TI-2024-26178 In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to… CVSS 3.1MEDIUM 5.4
  • TI-2021-07970 Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in Metadata CVSS 3.1MEDIUM 5.4
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences