CVE-2026-26832

CRITICAL

node-tesseract-ocr through 2.2.1 - Command Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-26832. PoCs published by zebbernCVE.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-26832, an OS command injection vulnerability in the `node-tesseract-ocr` npm package. It explains the root cause, affected component, and includes a proof-of-concept payload demonstrating the vulnerability.

Description

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization

Exploits (1)

nomisec WRITEUP

by zebbernCVE · poc

https://github.com/zebbernCVE/CVE-2026-26832

View Code ZIP pw:eip

This repository provides a detailed technical analysis of CVE-2026-26832, an OS command injection vulnerability in the `node-tesseract-ocr` npm package. It explains the root cause, affected component, and includes a proof-of-concept payload demonstrating the vulnerability.

Classification

Writeup 100%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: node-tesseract-ocr (all versions through 2.2.1)

No auth needed

Prerequisites: Untrusted file path input passed to the `recognize()` function

MITRE ATT&CK