Affected package: simple-thumbnail (npm), 1.6.5 and all earlier versions.
Weakness: CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Fixed version: none available. See Maintenance status below.
Usage at the time of reporting: around 3,100 downloads a week.
What the problem is
simple-thumbnail generates a thumbnail from a video or image by
running ffmpeg. Its genThumbnail() and ffmpegExecute() functions
(index.js) run ffmpeg with the shell option enabled and place the input and output
paths into the argument list wrapped only in plain double quotes. Because the whole command line
is then interpreted by a shell, and double quotes do not neutralise every form of shell
substitution, shell syntax in either path is executed rather than treated as part of a
filename.
Impact
A project that passes a path or a piece of text that a user can influence into the affected call hands that user the ability to run commands as the account the Node process runs under. Typical exposure is a web application that accepts an upload and then processes the stored file.
How to fix it
Run the external binary without a shell and pass each value as its own argument, using
child_process.execFile or child_process.spawn with an argument array. Every value
is then treated as literal text rather than as part of a command line. Quoting the values inside the
command string is not a reliable substitute.
Until a fixed release exists, projects depending on this package should either apply the change in a fork or move to a maintained alternative that does not build shell command strings from caller-supplied values.
Maintenance status
The latest release, 1.6.5, was published in January 2020, and the repository was last updated in May 2021. It carries no security policy and no private reporting channel, so the report was made to MITRE as CNA of last resort. No fixed version is available.
Timeline
- 10 September 2026: reported to MITRE as CNA of last resort, the affected project having no security policy and no private reporting channel.
- 29 September 2026: CVE ID assigned.
- 30 September 2026: this advisory published as the public reference for the CVE record.
Credit and method
Reported by Brian Willows, Graith Internet. The finding and its analysis were AI-assisted, using Claude, and every claim was verified locally against the published package before the report was filed. The verification detail is held privately and is available to a maintainer or to a CVE numbering authority on request.
References
This advisory is published so that the CVE record has a public reference. Corrections are welcome at security@graith.co.uk.