Executive brief
thumbler is a Node.js library for extracting thumbnails from video and image files. The package fails to sanitize user input passed to system commands, allowing attackers to inject arbitrary OS commands through parameters like input, output, time, or size. An attacker can execute unauthorized commands on systems using this library, potentially leading to data theft, system compromise, or lateral movement.
Technical details
thumbler through version 1.1.2 suffers from OS command injection (CWE-78, CWE-94) in the thumbnail() function. The vulnerability stems from unsanitized user input being concatenated directly into shell command strings passed to Node.js child_process.exec() without escaping or validation. Attackers can inject arbitrary shell metacharacters via the input, output, time, or size parameters to achieve remote code execution. The attack requires network access to an application using thumbler, but no authentication or user interaction is needed. No patch has been identified as of the advisory publication date; mitigation requires input validation and parameterized command execution.
Affected products
- thumbler thumbler through 1.1.2
Timeline
- 2026-03-25: disclosed
- 2026-03-31: other: GitHub advisory reviewed and confirmed