Threats tagged 'ghsa-7xrv-c458-6gmj'

A command injection vulnerability exists in the desmondmorris node-tesseract package up to version 0.2.7. The flaw is in the process function of lib/tesseract.js, specifically in the Command Builder component, where manipulation of the image argument can lead to OS command injection. This vulnerability can be exploited remotely. Public exploit code has been disclosed, but the project has not yet responded or issued a fix.