CVE-2026-26833: vulnerability facts

CVE-2026-26833

This page contains facts from public vulnerability sources. Check the original advisory before updating.

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.

CVSS 9.8 · Critical · EPSS 2.4%

Published: 2026-03-25T00:00:00.000Z
Updated: 2026-03-28T01:17:25.554Z

Stack: node

Affected products and versions

n/a
Versions
- n/a: Affected
No fix published
thumbler npm
Affected ranges
- SEMVER: ≤ 1.1.2
No fix published

Original sources

https://github.com/mmahrous/thumbler
https://www.npmjs.com/package/thumbler
https://github.com/mmahrous/thumbler/blob/master/lib/thumbler.js
https://github.com/zebbernCVE/CVE-2026-26833
https://nvd.nist.gov/vuln/detail/CVE-2026-26833

Check your server →

CVE-2026-26833

Affected products and versions

n/a

thumbler npm

Original sources