The thumbler package up to version 1.1.2 is vulnerable to OS command injection due to unsafe handling of user input in the thumbnail() function. Specifically, the input, output, time, or size parameters are concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping, allowing an attacker to execute arbitrary OS commands. This vulnerability is tracked as CVE-2026-26833 with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary operating system commands on the affected system with the privileges of the application running thumbler. This can lead to complete system compromise, data loss, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions of thumbler or restrict access to the affected functionality to trusted users only. Do not rely on generic mitigations as the vulnerability stems from unsafe command construction in the code.