CVE-2026-26832

CRITICAL

node-tesseract-ocr through 2.2.1 - Command Injection

Title source: llm
STIX 2.1

Description

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization

References (4)

Scores

CVSS v3 9.8
EPSS 0.0027
EPSS Percentile 50.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-78
Status published
Products (1)
npm/node-tesseract-ocr 0npm
Published Mar 25, 2026
Tracked Since Mar 25, 2026