CVE-2026-117511 - Vulnerability Details

- desmondmorris node-tesseract Command Builder tesseract.js process os command injection

Description

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-10-27

Score: 6.9 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exists in the node-tesseract library, up to version 0.2.7, where the Command Builder in lib/tesseract.js fails to sanitize the image path supplied to the underlying OCR process. An attacker can craft an image path containing shell metacharacters, causing the library to invoke an operating‑system command directly, which leads to remote command execution. The flaw is classified as CWE-77 and CWE-78.

Affected Systems

All installations of desmondmorris node-tesseract that are version 0.2.7 or earlier are vulnerable. This includes any Node.js application that imports or uses the library without applying a patch.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog; however, the payload has been publicly disclosed and can be triggered remotely. As the library is used at runtime, an attacker with write access to the data passed to the library can trigger the injection, making the risk significant for exposed services that rely on node-tesseract.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

desmondmorris

node-tesseract

affected

Version	Status	Constraints
`0.2.0`	affected	—
`0.2.1`	affected	—
`0.2.2`	affected	—
`0.2.3`	affected	—
`0.2.4`	affected	—
`0.2.5`	affected	—
`0.2.6`	affected	—
`0.2.7`	affected	—

No data.

Vendor Product Confidence Versions

Desmondmorris

Node-tesseract

95%

Version	Status	Scheme	Platform
`0.2.0`	affected	semver	—
`0.2.1`	affected	semver	—
`0.2.2`	affected	semver	—
`0.2.3`	affected	semver	—
`0.2.4`	affected	semver	—
`0.2.5`	affected	semver	—
`0.2.6`	affected	semver	—
`0.2.7`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update desmondmorris node-tesseract to a fixed release once one is available.
If an update is not yet released, replace the library with an alternative OCR solution that validates or escapes input parameters before invoking external commands.
Apply input validation and sanitization to the image argument, ensuring it cannot inject shell metacharacters or command separators.

Generated by OpenCVE AI on October 27, 2026 at 18:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/desmondmorris/node-tesseract/
https://github.com/desmondmorris/node-tesseract/issues/72
https://vuldb.com/cve/CVE-2026-117511
https://vuldb.com/submit/1024535
https://vuldb.com/vuln/427077
https://vuldb.com/vuln/427077/cti

History

Tue, 27 Oct 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		desmondmorris node-tesseract Command Builder tesseract.js process os command injection
First Time appeared		Desmondmorris Desmondmorris node-tesseract
Weaknesses		CWE-77 CWE-78
CPEs		cpe:2.3:a:desmondmorris:node-tesseract::::::::
Vendors & Products		Desmondmorris Desmondmorris node-tesseract
References		https://github.com/desmondmorris/node-tesseract/ https://github.com/desmondmorris/node-tesseract/issues/72 https://vuldb.com/cve/CVE-2026-117511 https://vuldb.com/submit/1024535 https://vuldb.com/vuln/427077 https://vuldb.com/vuln/427077/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Desmondmorris Node-tesseract

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-27T16:00:16.451Z

Updated: 2026-10-27T16:00:16.451Z

Reserved: 2026-10-27T09:00:38.622Z

Link: CVE-2026-117511

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-27T16:17:31.050

Modified: 2026-10-27T16:17:31.050

Link: CVE-2026-117511

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-27T19:30:09Z

Weaknesses

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object