Описание
node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter
node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization
Пакеты
node-tesseract-ocr
<= 2.2.1
Отсутствует
Связанные уязвимости
node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization
Уязвимость функции recognize() библиотеки node-tesseract-ocr программной платформы Node.js, позволяющая нарушителю оказать влияние на конфиденциальность, целостность и доступность защищаемой информации