GitHub Advisoryadvisory · npm

GHSA-83rx-c8cr-6j8q Insecure Default Configuration in tesseract.js

MEDIUM Published 2019-06-05 Modified 2021-08-04 Official page ↗
Ecosystem
npm
Packages
tesseract.js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-829
Reviewed
2019-06-05

Affected packages

• npm tesseract.js: < 1.0.19 → fixed in 1.0.19

Description

Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations. Recommendation Upgrade to version 1.0.19 or later.

Related

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References