node-ts-ocr CVE-2025-63705

No vendor-released patch or updated version has been identified at the time of analysis. The node-ts-ocr NPM package repository should be monitored for security updates addressing this command injection vulnerability. As an immediate compensating control, implement strict input validation on all parameters passed to the invokeImageOcr function, specifically whitelisting allowed characters in file paths and rejecting any input containing shell metacharacters such as semicolons, pipes, backticks, dollar signs, or command substitution syntax. Deploy the application with principle of least privilege, ensuring the Node.js process runs under a restricted service account with minimal file system and network access to limit command injection impact. For high-risk environments, consider replacing node-ts-ocr with alternative OCR libraries that have active security maintenance or implement OCR processing in isolated sandboxed containers with no access to sensitive resources. Authentication boundaries should be strengthened to ensure only trusted users can trigger OCR operations, and application-level logging should capture all invocations of invokeImageOcr for forensic detection. Reference the proof-of-concept at https://gist.github.com/6en6ar/a2ac44da0f4e580190be3e66cfbb9a4a to understand the exact exploitation technique and test validation controls.