CVE-2026-117511 in node-tesseract
Summary
by MITRE • 10/27/2026
A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in desmondmorris node-tesseract versions up to 0.2.7 represents a critical security flaw within the Command Builder component, specifically located in the process function found in lib/tesseract.js. This software library is designed to facilitate optical character recognition by interfacing with Tesseract OCR engines via Node.js. The core technical deficiency lies in how the application handles user-supplied input for the image argument. Instead of sanitizing or strictly validating this input before passing it to underlying system commands, the function allows arbitrary characters that can be interpreted as shell metacharacters. This lack of proper input validation and output encoding creates a direct pathway for OS command injection attacks. An attacker who controls the value passed to the image parameter can inject malicious shell commands that are executed by the operating system with the privileges of the running Node.js process.
From an operational perspective, this vulnerability poses severe risks due to its remote exploitability. Since node-tesseract is often used in web applications or API services where images are uploaded for processing, a remote attacker does not need local access to trigger the flaw. By crafting a specially formatted image filename or path that includes shell commands such as semicolons, pipes, or backticks, an adversary can force the server to execute arbitrary code. The impact of successful exploitation is extensive and potentially catastrophic. It typically results in full system compromise, allowing attackers to read sensitive files, modify application data, install malware, or use the compromised host as a pivot point for further network intrusion. In cloud environments, this could lead to the theft of instance metadata and credentials, escalating the breach beyond the immediate server.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The attack vector corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries use system utilities like sh or cmd.exe to execute malicious commands. Furthermore, because the exploit has been disclosed publicly, automated scanning tools and threat actors are likely already leveraging this knowledge against unpatched systems. The fact that the project maintainers have not yet responded to early issue reports indicates a potential gap in security maintenance practices for this specific library version, increasing the window of exposure for users who rely on it without implementing workarounds or migrating to patched versions if available.
Mitigation strategies must prioritize immediate remediation and defensive coding practices. The most effective solution is to upgrade node-tesseract to a version where this vulnerability has been resolved by the maintainers. If an update is not immediately feasible, developers should implement strict input validation on all image-related arguments before they are passed to the process function. This includes whitelisting allowed characters in filenames and rejecting any input containing shell metacharacters such as ; | & $ ` \ newline or space where inappropriate. Additionally, running the Node.js application with the least privilege principle is crucial; this means ensuring the process runs under a dedicated user account with minimal permissions to system resources. This limits the blast radius of an injection attack by preventing access to critical configuration files or administrative commands. Finally, organizations should monitor for signs of exploitation in server logs and consider using Web Application Firewalls that can detect common command injection patterns in HTTP requests handling file uploads.