Executive brief
node-ts-ocr is a software library used by developers to perform Optical Character Recognition (OCR), which converts text within images into machine-readable data. A security flaw in this library allows an attacker to execute unauthorized commands on the underlying server by providing a specially crafted filename. This could lead to a full system takeover, unauthorized data access, or disruption of services.
Technical details
The node-ts-ocr package (v1.0.15) is vulnerable to OS command injection within the `invokeImageOcr` function located in `src/index.js`. The vulnerability stems from the improper neutralization of the `imagePath` variable before it is concatenated into a shell command string used to call the Tesseract OCR engine. An attacker can exploit this by supplying a malicious string (e.g., containing shell metacharacters like semicolons) as the filename, which is then executed by the `child_process` module. This allows for arbitrary code execution with the privileges of the Node.js process. As of the advisory date, no patched version has been released.
Affected products
- nicolaspearson node-ts-ocr 1.0.15
Timeline
- 2026-05-06: disclosed: Initial public disclosure via GitHub Gist.
- 2026-05-07: advisory: Published to the GitHub Advisory Database and NVD.