Skip to content
OpenAdvisories

Package · npm

thumbler

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.8
    CVE-2026-26833 Public exploit

    thumbler allows OS Command Injection

    thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.

    thumbler npm