CVE-2026-26833 - Vulnerability Analysis

Overview

Thumbler through 1.1.2 contains a command injection caused by unsanitized user input concatenated into shell command strings in the thumbnail() function, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.

Severity & Score

Impact

Attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Mitigation

Update to the latest version of Thumbler.

References

• https://github.com/mmahrous/thumbler
• https://github.com/mmahrous/thumbler/blob/master/lib/thumbler.js
• https://github.com/zebbernCVE/CVE-2026-26833
• https://www.npmjs.com/package/thumbler

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner