GHSA-mvhf-547c-h55r

thumbler allows OS Command Injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-26833

Packages

Ecosystem	Package	Affected	Fixed in
npm	thumbler	<= 1.1.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-26833 advisory
https://github.com/mmahrous/thumbler package
https://github.com/mmahrous/thumbler/blob/master/lib/thumbler.js web
https://github.com/zebbernCVE/CVE-2026-26833 web
https://www.npmjs.com/package/thumbler web