Executive brief
node-tesseract-ocr is a software library used by developers to extract text from images within Node.js applications. A security flaw allows an attacker to execute unauthorized commands on the underlying server by providing a specially crafted file path to the image processing function. This could lead to a complete system takeover, data theft, or disruption of services.
Technical details
The node-tesseract-ocr library is vulnerable to OS command injection (CWE-78) within the recognize() function in src/index.js. The vulnerability exists because the 'input' parameter (representing a file path) is concatenated into a shell command string that is subsequently executed using child_process.exec(). While the input is wrapped in double quotes, it is not properly sanitized, allowing an attacker to break out of the quoted string using shell metacharacters (e.g., using a path like 'test.jpg"; touch /tmp/pwned; echo "x'). This allows for arbitrary command execution on the host system. As of the advisory date, no official patch is available; users are advised to use safer alternatives like child_process.spawn() or sanitize all inputs.
Affected products
- zapolnoch node-tesseract-ocr <= 2.2.1
Timeline
- 2026-03-25: disclosed
- 2026-03-25: advisory