Product
The thumbnail Python package through version 1.5 is vulnerable to OS command injection in the generate_thumbnail() function, enabling arbitrary code execution via shell metacharacter injection into system calls.