CVE-2026-26832: node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter
node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec() without proper sanitization
Published Mar 25, 2026 · Updated Mar 27, 2026
Affected packages
node-tesseract-ocr
- Ecosystem
- npm
- Affected
- <= 2.2.1
- Fixed in
- No patched version yet
- Check
npm ls node-tesseract-ocr
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology