Affected package: node-tesseract (npm), 0.2.7 and all earlier versions.
Weakness: CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Fixed version: none available. See Maintenance status below.
Usage at the time of reporting: around 600 downloads a week.
What the problem is
node-tesseract is a wrapper around the Tesseract OCR binary. Its
process() function (lib/tesseract.js) assembles a command line by joining
the binary name, the image path and the option values into a single string, and runs that string
through a shell with child_process.exec. None of the values are escaped, so shell
syntax in the image path or in the option values is interpreted by the shell rather than treated
as part of a filename.
Impact
A project that passes a path or a piece of text that a user can influence into the affected call hands that user the ability to run commands as the account the Node process runs under. Typical exposure is a web application that accepts an upload and then processes the stored file.
How to fix it
Run the external binary without a shell and pass each value as its own argument, using
child_process.execFile or child_process.spawn with an argument array. Every value
is then treated as literal text rather than as part of a command line. Quoting the values inside the
command string is not a reliable substitute.
Until a fixed release exists, projects depending on this package should either apply the change in a fork or move to a maintained alternative that does not build shell command strings from caller-supplied values.
Maintenance status
The latest release, 0.2.7, was published in June 2015, and the repository was last updated in August 2020. It carries no security policy and no private reporting channel, so the report was made to MITRE as CNA of last resort. No fixed version is available.
Timeline
- 10 September 2026: reported to MITRE as CNA of last resort, the affected project having no security policy and no private reporting channel.
- 29 September 2026: CVE ID assigned.
- 30 September 2026: this advisory published as the public reference for the CVE record.
Credit and method
Reported by Brian Willows, Graith Internet. The finding and its analysis were AI-assisted, using Claude, and every claim was verified locally against the published package before the report was filed. The verification detail is held privately and is available to a maintainer or to a CVE numbering authority on request.
References
This advisory is published so that the CVE record has a public reference. Corrections are welcome at security@graith.co.uk.