CVE-2026-26833 in thumbler
Summary
thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.
Responsible
MITRE
Reservation
02/16/2026
Disclosure
03/25/2026
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 353190 | thumbler thumbnail os command injection | 78 | Not defined | Not defined | CVE-2026-26833 |