What is the CVSS score of CVE-2026-26832?

CVE-2026-26832 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Node.js are affected by CVE-2026-26832?

A critical remote code execution vulnerability exists in the node-tesseract-ocr npm package (versions through 2.2.1) that allows unauthenticated attackers to execute arbitrary commands on affected…

How to fix or mitigate CVE-2026-26832?

Within 24 hours: Identify all applications and services using node-tesseract-ocr through dependency scanning and create an inventory of affected systems; isolate or restrict network access to affected applications if feasible. Within 7 days: Evaluate alternative OCR libraries without known vulnerabilities and begin migration planning; implement network segmentation to limit lateral movement from compromised systems. Within 30 days: Complete migration to patched or alternative solutions; conduct forensic analysis of logs for signs of exploitation; update all affected deployments.

Node.js CVE-2026-26832

EUVD-2026-15461 CRITICAL

OS Command Injection (CWE-78)

2026-03-25 mitre

GHSA-8j44-735h-w4w2

Node.js Command Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:16 euvd

EUVD-2026-15461

Analysis Generated

Mar 25, 2026 - 16:16 vuln.today

CVE Published

Mar 25, 2026 - 00:00 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

95 npm packages depend on node-tesseract-ocr (85 direct, 10 indirect)

Ecosystem-wide dependent count for version 2.2.1.

DescriptionCVE.org

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization

AnalysisAI

The node-tesseract-ocr npm package versions through 2.2.1 contains a critical OS command injection vulnerability in the recognize() function where file path parameters are concatenated into shell commands without sanitization before being passed to child_process.exec(). Attackers can achieve complete remote code execution with no authentication required. A proof-of-concept exploit exists at the GitHub repository linked in references (zebbernCVE/CVE-2026-26832), indicating active research into this vulnerability.

Technical ContextAI

This vulnerability affects node-tesseract-ocr, a Node.js wrapper for Tesseract OCR functionality published on npm. The root cause is CWE-78 (OS Command Injection) occurring in src/index.js where the recognize() function accepts user-controlled file paths and directly concatenates them into command strings executed via Node.js child_process.exec() without input validation or sanitization. This allows shell metacharacters and command separators to break out of the intended command context and execute arbitrary system commands. The affected package serves as a bridge between Node.js applications and the Tesseract OCR engine, making it common in document processing and image-to-text conversion workflows.

RemediationAI

As of this analysis, no patched version has been released for node-tesseract-ocr beyond version 2.2.1. Organizations should immediately audit their dependencies for this package and consider replacing it with alternative OCR libraries until a security update is available. As an immediate mitigation, implement strict input validation on any file paths before passing them to the recognize() function, specifically whitelisting allowed characters (alphanumeric, underscores, hyphens, periods) and rejecting paths containing shell metacharacters such as semicolons, pipes, backticks, dollar signs, and ampersands. Deploy the application in a sandboxed environment with minimal system privileges and use container security controls to limit the blast radius of potential command execution. Monitor the official GitHub repository at https://github.com/zapolnoch/node-tesseract-ocr for security patches and consider forking the package to implement sanitization if business continuity requires continued use.