Vulnerability Description
thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mmahrous | Thumbler | <= 1.1.2 |
Related Weaknesses (CWE)
References
- https://github.com/mmahrous/thumblerProduct
- https://github.com/mmahrous/thumbler/blob/master/lib/thumbler.jsNot Applicable
- https://github.com/zebbernCVE/CVE-2026-26833Vendor AdvisoryExploit
- https://www.npmjs.com/package/thumblerProduct
FAQ
What is CVE-2026-26833?
CVE-2026-26833 is a vulnerability with a CVSS score of 9.8 (CRITICAL). thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to c...
How severe is CVE-2026-26833?
CVE-2026-26833 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-26833?
Check the references section above for vendor advisories and patch information. Affected products include: Mmahrous Thumbler.