Remote code execution in dawnsparks-node-tesseract

KRITISCH 9.8CVE-2023-29566 · GHSA-88qf-5f3v-pm6m · Published 24/04/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-29566 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in dawnsparks-node-tesseract (dawnsparks-node-tesseract project), huedawn-tesseract (huedawn-tesseract project), dawnsparks-node-tesseract.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.2%, höher als bei 82.3% aller Schwachstellen.
Abhilfe: auf 0.4.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
dawnsparks-node-tesseract dawnsparks-node-tesseract_project	`= 0.4.0= 0.4.1`	No fix yet
huedawn-tesseract huedawn-tesseract_project	`= 0.3.0`	No fix yet
dawnsparks-node-tesseract npm	`< 0.4.1`	`0.4.1`

Description

dawnsparks-node-tesseract before 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.

NVD description

huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.

References

nvd.nist.gov/vuln/detail/CVE-2023-29566 · ADVISORY
rona-dinihari/dawnsparks-node-tesseract commit 81d1664 · WEB
omnitaint/Vulnerability-Reports · WEB
rona-dinihari/dawnsparks-node-tesseract · PACKAGE
npmjs.com/package/dawnsparks-node-tesseract · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free