QwikSec

Security Database

CVE

CWE

Training

CVE-2026-26832

Published: Mar 25, 2026

Modified: Mar 25, 2026

PUBLISHED

CVSS v3.1

9.8

CRITICAL

Description

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization

Vendor	Product	Versions
n/a	n/a	affected `n/a`

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Attack Complexity

Low

Attack Vector

Network

Availability

High

Confidentiality

High

Integrity

High

Privileges Required

None

Scope

Unchanged

User Interaction

None

References

https://www.npmjs.com/package/node-tesseract-ocr

https://github.com/zapolnoch/node-tesseract-ocr

https://github.com/zapolnoch/node-tesseract-ocr/blob/master/src/index.js

https://github.com/zebbernCVE/CVE-2026-26832

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.