OS Command Injection In node-tesseract-ocr
Description
node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version |
|---|---|---|
 npm |
Aliases
1. 2. 3. 4.
References
1. 2.