CVE-2026-26832

Published: Mar 25, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: MITRE (Secondary)

Description

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization

Affected (1)

Products: Zapolnoch: Tesseract Ocr

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zapolnoch Tesseract Ocr	Up to 2.2.1

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

https://github.com/zapolnoch/node-tesseract-ocr

Source: cve@mitre.org

Product

https://github.com/zapolnoch/node-tesseract-ocr/blob/master/src/index.js

Source: cve@mitre.org

Product

https://github.com/zebbernCVE/CVE-2026-26832

Source: cve@mitre.org

MitigationThird Party Advisory

https://www.npmjs.com/package/node-tesseract-ocr

Source: cve@mitre.org

Product

Timeline

No history available yet.