Any file can contain exploits designed to attack particular reader software. EPUB3 format can contain executable javascript, but, other than Sigil, most reader apps ignore it. They're certainly safer than most things people download, but nothing online is truly safe.