CVE-2026-110650
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in…
- Risk score
- 91/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 3.0%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into o…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Red
- CVSS 9.8 critical
- Remotely exploitable without logging in
- On your watchlist: python
References
- https://github.com/anshulkharb/thumbnail/blob/23b2e30509c936872a3bafac65b4aa48777e794c/thumbnail/thumbnail.py#L100-L114
- https://github.com/anshulkharb/thumbnail/pull/9
- https://www.vulncheck.com/advisories/thumbnail-through-1.5-os-command-injection-via-generate-thumbnail-file-paths
- https://github.com/anshulkharb/thumbnail/pull/9
Original description
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
Last activity 14 Oct 2026. Patch Forecast updates every hour.