The thumbnail Python package contains an OS command injection flaw in generate_thumbnail(). By supplying shell metacharacters in a file path, an attacker can inject commands into the os.system() calls that invoke ffmpeg, convert, or unoconv. This allows execution of arbitrary commands with the privileges of the Python process, resulting in full remote code execution on the host.

The vulnerability exists in the anshulkharb:thumbnail package versions up to 1.5. Any installation of thumbnail 1.5 or earlier that allows unauthenticated users to provide file names to generate_thumbnail() is affected.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of 3% suggests a non-negligible likelihood of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector involves an attacker supplying a crafted file name or file path when invoking generate_thumbnail(), such as during a file upload or other user‑controlled input. Exploitation requires the attacker to be able to trigger generate_thumbnail() and thus have some level of interaction with the application. Given the high severity and lack of mitigations in older versions, the risk remains high.