CVE-2026-117511: desmondmorris node-tesseract Command Builder tesseract.js process os command injection
A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using desmondmorris node-tesseract versions up to 0.2.7 are affected where an attacker can influence the image argument passed to the process function in lib/tesseract.js. The attack can be executed remotely.
What does an attacker need to exploit this issue?
An attacker needs control over the image argument handled by the Command Builder's process function. No privileges or user interaction are indicated by the supplied severity vector.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
Is a vendor fix available?
The provided information does not identify a fixed version. It states that the project was notified through an issue report but had not responded.