CVE-2026-26832

Published March 25th, 2026

View on NVD ↗

CVSS v3

9.8

CRITICAL

CVSS v2

N/A

Affected

PROJECTS

Description

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization

zapolnoch/node-tesseract-ocr

A Node.js wrapper for the Tesseract OCR API

GitHub

318

zebbernCVE/CVE-2026-26832

Advisory for node-tesseract-ocr ⌯⌲ 50 000 weekly downloads

GitHub

node-tesseract-ocr

A Node.js wrapper for the Tesseract OCR API

NPM