CVE-2026-26833

CRITICAL

thumbler <=1.1.2 - Command Injection

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-26833. PoCs published by zebbernCVE.

AI-analyzed exploit summary This repository contains detailed technical writeups for four npm package vulnerabilities (CVE-2026-26830, CVE-2026-26831, CVE-2026-26832, CVE-2026-26833), all involving OS command injection due to unsafe shell command construction. Each writeup includes vulnerability details, proof-of-concept examples, and mitigation advice.

Description

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.

Exploits (2)

github WRITEUP 1 stars

by zebbernCVE · poc

https://github.com/zebbernCVE/npm-cve-2026-26830-26833

View Code ZIP pw:eip

This repository contains detailed technical writeups for four npm package vulnerabilities (CVE-2026-26830, CVE-2026-26831, CVE-2026-26832, CVE-2026-26833), all involving OS command injection due to unsafe shell command construction. Each writeup includes vulnerability details, proof-of-concept examples, and mitigation advice.

Classification

Writeup 100%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: pdf-image (through 2.0.0), textract (through 2.5.0), node-tesseract-ocr (through 2.2.1), thumbler (through 1.1.2)

No auth needed

Prerequisites: Attacker-controlled file path or input passed to vulnerable npm packages

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed May 01, 2026 Full analysis →

nomisec WRITEUP

by zebbernCVE · poc

https://github.com/zebbernCVE/CVE-2026-26833

View Code ZIP pw:eip

The repository provides a detailed technical analysis of CVE-2026-26833, an OS command injection vulnerability in the 'thumbler' npm package. It includes a proof-of-concept exploit demonstrating how attacker-controlled input can lead to arbitrary command execution via improper shell string concatenation in the `thumbnail()` function.

Classification

Writeup 100%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: thumbler npm package (versions through 1.1.2)

No auth needed

Prerequisites: Access to a service using the vulnerable 'thumbler' package · Ability to control input parameters passed to the `thumbnail()` function

MITRE ATT&CK