TI-2026-74144 CVE-2026-110650 · GHSA-542h-xc5c-6hxmOS command injection in thumbnail Python packagePriority HIGH 81The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths.CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.02994 · Published 2026-10-14 · No fix listed CWE-78