Live › vulnerability › CVE-2026-117511
Go to dashboardThe node-tesseract npm package builds a shell command from the image argument passed to its process function in lib/tesseract.js, without sanitizing it. An attacker who controls that argument can run arbitrary operating system commands on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Applications that use node-tesseract up to version 0.2.7 and pass user-influenced values as the image argument to its process function are exposed. Systems that only OCR files the team itself controls, with no user input reaching that argument, are a lower risk. unknown whether other versions or configurations are affected.
No product ranges from the sources yet.
npm ls node-tesseract in each project to find whether it is installed and at which versionprocess( from the node-tesseract module that take user-supplied file paths or namesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-117511")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.