CVE-2025-63705 - NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js

HIGH

NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js

Published May 7, 2026

8.8

HIGH

CVSS 3.1

EPSS 1.19%

NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://gist.github.com/6en6ar/a2ac44da0f4e580190be3e66cfbb9a4a		exploit
https://github.com/advisories/GHSA-8jh2-3mw6-6pfm		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-63705
https://www.npmjs.com/package/node-ts-ocr

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published May 7, 2026

Updated May 8, 2026

Reserved Oct 27, 2025

Updated May 8, 2026

Status Awaiting Analysis

Modified Jun 17, 2026

Severity n/a

Public date n/a