The vulnerability occurs in the node-ts-ocr NPM package, version 1.0.15, where the invokeImageOcr function fails to properly validate input used in a shell command, allowing an attacker to inject arbitrary OS commands. Successful exploitation could result in remote code execution, compromising the confidentiality, integrity, and availability of the systems running the application.

Any application that depends on node-ts-ocr 1.0.15 is affected. No specific operating system is mentioned, so the impact applies wherever the package is deployed, including Node.js environments that run the vulnerable code.

The CVE does not list a CVSS score or EPSS. The vulnerability is not listed in CISA KEV. OS command injection is a high‑risk flaw; an attacker with access to the invokeImageOcr API could execute arbitrary commands. The lack of official remediation data suggests the risk remains significant until a patch or alternative solution is applied.