thumbler, a Node.js library for image processing, has an OS command injection flaw in its thumbnail() function. User‑supplied values for the input, output, time, or size parameters are concatenated directly into a shell command that is executed with child_process.exec(). This allows an attacker to inject arbitrary shell commands, giving full control over the operating system on any system where the library runs.

The flaw affects the npm package thumbler, version 1.1.2 and earlier. Any application or utility that imports thumbler and calls thumbnail()—for example web services or command‑line tools running in a Node.js environment—is at risk.

The CVSS score of 9.8 indicates a critical severity. EPSS is below 1 %, implying a relatively low probability of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is the injection of malicious data into the thumbnail() parameters, which could occur through an exposed web endpoint or a command‑line script. If such data can reach the library, arbitrary commands would execute with the process’s privileges, potentially compromising the entire host.