Skip to content
OpenAdvisories

Package · npm

node-tesseract-ocr

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-26832 Public exploit

    node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter

    node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command…

    node-tesseract-ocr npm