Critical severity9.8NVD Advisory· Published Mar 25, 2026· Updated Jun 17, 2026
CVE-2026-26833
CVE-2026-26833
Description
thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
thumblernpm | <= 1.1.2 | — |
Affected products
3- thumbler/thumblerdescription
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-mvhf-547c-h55rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-26833ghsaADVISORY
- github.com/mmahrous/thumbler/blob/master/lib/thumbler.jsnvdNot ApplicableWEB
- www.npmjs.com/package/thumblernvdProductWEB
News mentions
0No linked articles in our index yet.