Thumbnail
Monthly
OS command injection in the thumbnail Python package through version 1.5 allows attackers who control a filename passed to generate_thumbnail() to execute arbitrary shell commands with the privileges of the Python process. The vulnerable code concatenates user-influenced values (input, output, width, height, quality, trim) directly into os.system() calls invoking ffmpeg, convert or unoconv, so shell metacharacters such as ';', backticks or $(...) in a filename break out of the intended command. The package is a library with no network listener of its own, so real-world reachability depends on the consuming application exposing untrusted filenames - classically a file-upload feature - and on ffmpeg/convert/unoconv being installed for the relevant code branch; where those conditions hold, no authentication or user interaction beyond submitting the malicious filename is required. An upstream fix exists in pull request #9, and no public exploit code has been identified at time of analysis.
OS command injection in the thumbnail Python package through version 1.5 allows attackers who control a filename passed to generate_thumbnail() to execute arbitrary shell commands with the privileges of the Python process. The vulnerable code concatenates user-influenced values (input, output, width, height, quality, trim) directly into os.system() calls invoking ffmpeg, convert or unoconv, so shell metacharacters such as ';', backticks or $(...) in a filename break out of the intended command. The package is a library with no network listener of its own, so real-world reachability depends on the consuming application exposing untrusted filenames - classically a file-upload feature - and on ffmpeg/convert/unoconv being installed for the relevant code branch; where those conditions hold, no authentication or user interaction beyond submitting the malicious filename is required. An upstream fix exists in pull request #9, and no public exploit code has been identified at time of analysis.