VYPR
← All advisories
Critical severityOSV Advisory· Published Jul 25, 2022· Updated Sep 17, 2024

Command Injection

CVE-2020-28446

Description

The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ntesseractnpm
< 0.2.90.2.9

Affected products

1

Patches

1
fcbc36f38179

fix: vulnerable to command injection

https://github.com/taoyuan/ntesseracttyDec 14, 2020via ghsa
commit
2 files changed · +5 −1
  • lib/tesseract.js+4 −0 modified
    @@ -36,6 +36,10 @@ const Tesseract = {
   outputEncoding: 'UTF-8',
 
   command: function (image, options) {
+    if (image.startsWith('"')) {
+      image = '"' + image + '"';
+    }
+
     // assemble tesseract command
     const command = [options.binary, image, options.output];
  • package.json+1 −1 modified
    @@ -30,6 +30,6 @@
   },
   "license": "MIT",
   "engine": {
-    "node": ">=0.6"
+    "node": ">=8.0"
   }
 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.