GitHub Advisoryadvisory · npm
GHSA-8jh2-3mw6-6pfm node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
HIGH
Official page ↗
- Aliases
- CVE-2025-63705
- Ecosystem
- npm
- Packages
- node-ts-ocr
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
- Reviewed
- 2026-05-12
Affected packages
• npm node-ts-ocr: 1.0.15 (no fix yet)
Description
NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.
Related
Alias · CVE (1)
- CVE-2025-63705 NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js. vulnerability
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness