PT-2026-27801 · Unknown · Node-Tesseract-Ocr

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-26832

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions node-tesseract-ocr versions through 2.2.1

Description The recognize() function in src/index.js is susceptible to OS Command Injection due to insufficient input sanitization. Specifically, the file path parameter is incorporated into a shell command string and executed using child process.exec() without adequate validation. This allows for potential remote code execution.

Recommendations Versions prior to 2.2.1 are affected.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-26832

Affected Products

Node-Tesseract-Ocr

References · 7

• 🔥 https://github.com/zebbernCVE/CVE-2026-26832 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26832 · Security Note
• https://github.com/zapolnoch/node-tesseract-ocr/blob/master/src/index.js · Note
• https://github.com/zapolnoch/node-tesseract-ocr · Note
• https://twitter.com/0dayPublishing/status/2036841625360437434 · Twitter Post
• https://npmjs.com/package/node-tesseract-ocr · Note
• https://twitter.com/CveFindCom/status/2036846484528721970 · Twitter Post