OS Command Injection Vulnerability in Desmond Morris Node-Tesseract
CVE-2026-117511

6.9MEDIUM

Key Information:

Vendor: Desmondmorris
Status: Node-tesseract
Vendor: CVE Published:; 27 October 2026

🔔 Create Desmondmorris Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-117511?

A remote exploit affecting the Desmond Morris node-tesseract up to version 0.2.7 has been identified, allowing attackers to manipulate function arguments in the Command Builder's lib/tesseract.js file, leading to potential OS command injection vulnerabilities. The issue, disclosed publicly, poses significant risks as it enables unauthorized command execution on the affected system. Despite prior notification of the vulnerability through an issue report, no action has been taken by the project maintainers, raising concerns about user security.

Affected Version(s)

node-tesseract 0.2.0

node-tesseract 0.2.1

node-tesseract 0.2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-117511 - Proof of Concept