{"id":"CVE-2026-110650","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-110650","summary":"The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters…","details":"The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.","published":"2026-10-14T15:17:18.793","modified":"2026-10-14T15:17:18.793","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/anshulkharb/thumbnail/pull/9","label":"anshulkharb/thumbnail#9"},"references":[{"type":"WEB","url":"https://github.com/anshulkharb/thumbnail/blob/23b2e30509c936872a3bafac65b4aa48777e794c/thumbnail/thumbnail.py#L100-L114"},{"type":"WEB","url":"https://github.com/anshulkharb/thumbnail/pull/9"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/thumbnail-through-1.5-os-command-injection-via-generate-thumbnail-file-paths"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-14T15:17:18.793"}}