zebberncve/cve-2026-26833Advisory for thumbler
thumbler through version 1.1.2 allows OS command injection in
thumbnail() in lib/thumbler.js. The package concatenates the
input, output, time, and size values into a single ffmpeg
command string and executes that string with child_process.exec().
An attacker who controls one of those values can inject shell syntax
and run arbitrary commands.
| Product | Affected versions | Fixed version |
|---|---|---|
| thumbler | all versions through 1.1.2 | no fix available as of 2026-03-24 |
CVE-2026-26833CWE-78 - OS Command Injection9.8 (Critical)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hlib/thumbler.js, thumbnail()The vulnerable code path constructs the following shell string:
exec(
'ffmpeg -ss ' + time + ' -i "' + input + '" -vframes 1 -s ' +
size + ' "' + output + '"',
...
);
Because the command is assembled as a string, each attacker-controlled field is a possible injection point.
Any service that generates thumbnails from user-controlled media can
end up executing commands on the host while calling thumbnail().
require("thumbler").thumbnail(
'test.mp4"; id > /tmp/pwned; echo "',
"/tmp/out.jpg",
{},
() => {}
);
No fixed npm release is available at the time of writing.
If you still depend on this package:
thumbnail().