Node.js Wrapper for Tesseract OCR Vulnerability Exposes Command Injection Risk

CVE-2026-26832

What is CVE-2026-26832?

The node-tesseract-ocr package provides an interface for integrating Tesseract OCR in Node.js applications. In all versions up to 2.2.1, a vulnerability exists in the recognize() function, where an attacker can exploit unsanitized file path inputs. This input is concatenated into a command string and executed via child_process.exec(), leading to OS command injection. This could allow an attacker to execute arbitrary commands on the host machine, potentially compromising the integrity and security of the system. Developers using this package should evaluate their applications and implement necessary mitigations to safeguard their environments.

References