Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths

Summary

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.

Evidence

The exploit was run against the published artifact from the registry, not the repository. It created a marker file; a benign input through the same sink in the same session did not.

Remediation

No fixed release was published at disclosure. Don't pass untrusted file names or strings to the affected functions, or apply the patch from the fix pull request.

References

• VulnCheck advisoryhttps://www.vulncheck.com/advisories/thumbnail-through-1.5-os-command-injection-via-generate-thumbnail-file-paths
• Fix pull requesthttps://github.com/anshulkharb/thumbnail/pull/9
• Vulnerable codehttps://github.com/anshulkharb/thumbnail/blob/23b2e30509c936872a3bafac65b4aa48777e794c/thumbnail/thumbnail.py#L100-L114
• CVE recordhttps://www.cve.org/CVERecord?id=CVE-2026-110650