CVE-2026-73066 Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count,...

CVE-2026-73066 Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count,...

CVE-2026-73066 Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count,...

PT-2026-70224

Name of the Vulnerable Software and Affected Versions Tesseract versions prior to 5.5.3 Description A heap out-of-bounds write can occur during OCR recognition when a crafted .traineddata LSTM model component is loaded through the deserializer. This happens because an unchecked signed integer...

PT-2026-70225

Name of the Vulnerable Software and Affected Versions Tesseract versions prior to 5.5.3 Description A heap out-of-bounds read occurs when a crafted .traineddata model is loaded through the TessBaseAPI::Init function. This happens because SquishedDawg::read squished dawg in src/dict/dawg.cpp accep...

cisco-hypershield

Ansible Collection: stevefulme1.ciscohypershield Ansible Col...

📄 node-tesseract-ocr 2.2.1 Command Injection

In node-tesseract-ocr version 2.2.1, a security vulnerability allows OS command injection when attacker-controlled image paths are passed to the OCR function. ================================================================================================================================== | Title...

The vulnerability of the recognize() function in the node-tesseract-ocr library of the Node.js software platform allows attackers to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the recognize function in the node-tesseract-ocr library of the Node.js software platform is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to influence the confidentiality, integrity, and...

CVE-2026-26832

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

📄 node-tesseract-ocr 2.2.1 Command Injection

node-tesseract-ocr through version 2.2.1 allows OS command injection in recognize in src/index.js. The package builds a shell command string and executes it with childprocess.exec. Because the input path is only wrapped in double quotes, an attacker can inject shell syntax through a crafted file...

Command Injection

Overview node-tesseract-ocr is an A Node.js wrapper for the Tesseract OCR API Affected versions of this package are vulnerable to Command Injection via the recognize function. An attacker can execute arbitrary system commands by supplying crafted input to the file path parameter, which is...

@aaquib/whatsasenanpm (1.3.5), @alexandersen01/sharepoint-mcp-server-better (0.3.23) +86 more potentially affected by CVE-2026-26832 via node-tesseract-ocr (>=0.1.0, <=2.2.1)

node-tesseract-ocr NPM version =0.1.0, =1.0.10, =0.0.1, =2.3.50-snapshot-1724322551764, =2.0.0, =0.0.1, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =0.0.4 and more Source cves: CVE-2026-26832 Source advisory: SNYK:JS-NODETESSERACTOCR-15874141...

node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

@aaquib/whatsasenanpm (1.3.5), @alexandersen01/sharepoint-mcp-server-better (0.3.23) +81 more potentially affected by CVE-2026-26832 via node-tesseract-ocr (2.2.1)

node-tesseract-ocr NPM version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on node-tesseract-ocr and may be impacted: - @aaquib/whatsasenanpm 1.3.5 - @alexandersen01/sharepoint-mcp-server-better 0.3.23 - @artdotstyle/filepix =1.0.10, =0.0.1,...

EUVD-2026-15461

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

GHSA-8J44-735H-W4W2 node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

CVE-2026-26832

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

CVE-2026-26832

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

PT-2026-27801

Name of the Vulnerable Software and Affected Versions node-tesseract-ocr versions through 2.2.1 Description The recognize function in src/index.js is susceptible to OS Command Injection due to insufficient input sanitization. Specifically, the file path parameter is incorporated into a shell...

CVE-2026-26832

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...