| Title | Desmond Morris node-tesseract 0.0.1-0.2.7 OS Command Injection |
|---|
| Description | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical or 8.8 if behind authentication)
CWE-78
node-tesseract (https://www.npmjs.com/package/node-tesseract) v0.2.7 and all previous prior versions (down to initial release version 0.0.1) are vulnerable to an OS command injection vulnerability.
The process(image, options, callback) function present in lib/tesseract.js builds a command by string concatenation. The image argument is neither escaped nor quoted, allowing for shell characters to enter into the input freely. The final command is then executed by (child_process) - exec() function. This allows the injection of arbitrary commands into the command builder. On Linux exec defaults to /bin/sh -c
Additionally, options.binary, options.l, options.psm, and options.config are also vulnerable to this and can be used as injection points.
Malicious input is passed inside the image variable "x.png; touch /tmp/pwned #". A comment is used to make sure nothing else runs. The shell receives:
tesseract x.png ; touch /tmp/pwned # /tmp/node-tesseract-<uuid>
Thus our command gets executed
PoC: node -e 'require("node-tesseract").process("x.png; touch /tmp/pwned #", ()=>{})'
|
|---|
| Source | ⚠️ https://github.com/desmondmorris/node-tesseract/issues/72 |
|---|
| User | ma1ware (UID 102050) |
|---|
| Submission | 10/11/2026 14:32 (20 days ago) |
|---|
| Moderation | 10/27/2026 10:01 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 427077 [desmondmorris node-tesseract up to 0.2.7 Command Builder lib/tesseract.js process image os command injection] |
|---|
| Points | 20 |
|---|