Node Tesseract
Monthly
OS command injection in the desmondmorris node-tesseract npm library (versions 0.2.0 through 0.2.7) allows remote attackers to execute arbitrary shell commands when a consuming application passes unsanitized input into the 'image' argument of the process() function in lib/tesseract.js, because the Command Builder concatenates that value into the Tesseract OCR shell invocation. The package is not exploitable in isolation: reachability, authentication requirements and real-world impact depend entirely on the host application that exposes the image parameter to untrusted input. A public PoC reference exists in the project's GitHub issue tracker; it is not verified as working exploit code, and no vendor fix has been released because the maintainer has not responded to the report.
OS command injection in the desmondmorris node-tesseract npm library (versions 0.2.0 through 0.2.7) allows remote attackers to execute arbitrary shell commands when a consuming application passes unsanitized input into the 'image' argument of the process() function in lib/tesseract.js, because the Command Builder concatenates that value into the Tesseract OCR shell invocation. The package is not exploitable in isolation: reachability, authentication requirements and real-world impact depend entirely on the host application that exposes the image parameter to untrusted input. A public PoC reference exists in the project's GitHub issue tracker; it is not verified as working exploit code, and no vendor fix has been released because the maintainer has not responded to the report.