CVE-2026-26833 is a critical (CVSS 9.8) OS command injection in the npm package thumbler through version 1.1.2. The input, output, time and size parameters of thumbnail() are joined into a shell command. The record names no fixed version, so keep untrusted values out of those arguments.
What's affected
The record says thumbler through 1.1.2 is affected. The vulnerable function is thumbnail(), in lib/thumbler.js, and the four parameters are input, output, time and size.
No patched version is named. Check the repository and npm page for a newer release.
How to check if you're exposed
npm ls thumbler
npm ls --all | grep thumbler
Then search your code for thumbnail( calls and look at where the arguments come from. A file path from your own storage is a different risk from a size or time value taken from a query string. Safeguard has a free in-browser dependency scan at https://gold.safeguard.sh/scan that checks a dependency file against known CVEs.
What to do now
- Find every project that depends on thumbler, directly or through another package.
- Check what feeds the four parameters and make sure none come straight from a request.
- Validate time and size as numbers and build input and output paths on the server.
- Look for a newer release and upgrade if one addresses this CVE.
- If the package is unmaintained, move thumbnail generation to a library that passes arguments as an array without a shell.
Why it matters
The record lists CWE-78 and CWE-94. The package concatenates user input into a command string for child_process.exec(), which hands the string to a shell. Any shell syntax in a value then runs as part of the command.
The safer pattern is to call a program with an argument list, so no shell parses the values. The record does not flag this CVE as known exploited.
Quick check
Which parameters are involved?
Input, output, time and size in the thumbnail() function.
Sources
- CVE-2026-26833 on Gold
- NVD record for CVE-2026-26833, published 25 March 2026
- Project repository listed in the record: https://github.com/mmahrous/thumbler
- npm package page listed in the record: https://www.npmjs.com/package/thumbler
Last reviewed: 19 October 2026.
