Executive brief
tesseract.js is a popular JavaScript library that performs optical character recognition (OCR) in web browsers. Versions prior to 1.0.19 default to routing requests through a third-party proxy service (crossorigin.me) not designed for production use, potentially exposing sensitive data in transit and causing service instability for applications relying on this library.
Technical details
The vulnerability is a use of an insecure default configuration (CWE-829) where the library automatically routes cross-origin OCR requests through an untrusted third-party CORS proxy without user awareness or consent. The affected versions (all prior to 1.0.19) hardcode crossorigin.me as the proxy endpoint, which explicitly disclaims suitability for production environments. Requests made through this proxy are not encrypted or protected, allowing network-level eavesdropping on OCR data and potentially sensitive document content. The fix, released in version 1.0.19, modifies the default proxy configuration or error handling to eliminate reliance on the insecure proxy. No authentication or special network access is required—any web application embedding an affected version automatically exposes OCR traffic.
Affected products
- naptha tesseract.js prior to 1.0.19
Timeline
- 2019-06-05: disclosed: Public advisory publication
- 2019-05-12: patched: PR #267 merged with fix for CORS proxy security issue