CVE-2025-63705 identifies an OS command injection vulnerability in the node-ts-ocr NPM package, specifically in the invokeImageOcr function in src/index.js. This vulnerability allows an attacker to inject and execute arbitrary OS commands through this function. The vulnerability was published on May 7, 2026, but no CVSS score, patch, or remediation details are currently available. The package is not a cloud service, and no known exploits have been reported. The affected version is 1.0.15, but no further version details are provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary operating system commands on the host running the vulnerable node-ts-ocr package. This could lead to unauthorized system access, data compromise, or further system exploitation depending on the privileges of the executing process. No known exploits in the wild have been reported, and the extent of impact depends on the deployment context and usage of the vulnerable function.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input with the invokeImageOcr function or consider removing or replacing the node-ts-ocr package if possible. Monitor official sources for updates regarding patches or mitigations.