Open-source package vulnerability · npm

CVE-2026-26833: thumbler allows OS Command Injection

criticalCVSS 3.1 9.8GHSA-mvhf-547c-h55r

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to childprocess.exec() without proper sanitization or escaping.

Published Mar 25, 2026 · Updated Mar 31, 2026

Affected packages

thumbler

Ecosystem: npm
Affected: <= 1.1.2
Fixed in: No patched version yet
Check: npm ls thumbler

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology