{"id":"CVE-2026-110650","published":"2026-10-14T15:17:18.793","lastModified":"2026-10-15T14:47:05.720","description":"The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/anshulkharb/thumbnail/blob/23b2e30509c936872a3bafac65b4aa48777e794c/thumbnail/thumbnail.py#L100-L114","tags":[]},{"url":"https://github.com/anshulkharb/thumbnail/pull/9","tags":[]},{"url":"https://www.vulncheck.com/advisories/thumbnail-through-1.5-os-command-injection-via-generate-thumbnail-file-paths","tags":[]},{"url":"https://github.com/anshulkharb/thumbnail/pull/9","tags":[]}],"exploitRefs":[{"url":"https://github.com/anshulkharb/thumbnail/blob/23b2e30509c936872a3bafac65b4aa48777e794c/thumbnail/thumbnail.py#L100-L114","tags":[]},{"url":"https://github.com/anshulkharb/thumbnail/pull/9","tags":[]},{"url":"https://github.com/anshulkharb/thumbnail/pull/9","tags":[]}],"hasPoc":true,"ai":{"summary":"The thumbnail Python package has an OS command injection vulnerability that allows attackers to execute arbitrary commands on the system by injecting shell metacharacters into file paths. This critical flaw can lead to complete system compromise when attackers upload malicious files.","exploitability":"Exploitation is straightforward for attackers who can control file names passed to generate_thumbnail, requiring only basic shell metacharacters in filenames to trigger command execution with the privileges of the Python process.","blast_radius":"The impact could be severe across all systems using the thumbnail package, potentially allowing attackers to execute arbitrary commands with the privileges of the application, leading to full system compromise or data exfiltration.","remediation":"Upgrade to version 1.6 or later which contains the fix for the OS command injection vulnerability in generate_thumbnail().","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","python"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:49:52.384Z"}}