PT-2023-22308 · Unknown · Huedawn-Tesseract+1

Published 2023-04-24 · Updated 2025-02-04 · CVE-2023-29566

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions huedawn-tesseract version 0.3.3 dawnsparks-node-tesseract versions 0.4.0 through 0.4.1

Description The issue is related to a remote code execution (RCE) vulnerability via the child process function.

Recommendations For huesdawn-tesseract version 0.3.3, update to a version that fixes the issue. For dawnsparks-node-tesseract versions 0.4.0 through 0.4.1, update to a version later than 0.4.1. As a temporary workaround, consider disabling the child process function until a patch is available.

Exploit

Fix

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

CVE-2023-29566

GHSA-88QF-5F3V-PM6M

Affected Products

Dawnsparks-Node-Tesseract

Huedawn-Tesseract

References · 9

• 🔥 https://github.com/omnitaint/Vulnerability-Reports/blob/ec3645003c7f8996459b5b24c722474adc2d599f/reports/dawnsparks-node-tesseract/report.md · Exploit
• https://github.com/rona-dinihari/dawnsparks-node-tesseract/commit/81d1664f0b9fe521534acfae1d5b9c40127b36c1 · Patch
• https://osv.dev/vulnerability/GHSA-88qf-5f3v-pm6m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29566 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29566 · Vendor Advisory
• https://github.com/rona-dinihari/dawnsparks-node-tesseract · Note
• https://npmjs.com/package/dawnsparks-node-tesseract · Note
• https://t.me/cvenotify/109915 · Telegram Post
• https://t.me/cibsecurity/62751 · Telegram Post