Remote code execution in dawnsparks-node-tesseract

CRITIQUE 9.8CVE-2023-29566 · GHSA-88qf-5f3v-pm6m · Published 24/04/2023 · updated 17/06/2026

En bref

CVE-2023-29566 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant dawnsparks-node-tesseract (dawnsparks-node-tesseract project), huedawn-tesseract (huedawn-tesseract project), dawnsparks-node-tesseract.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.2%, plus élevée que 82.3% des vulnérabilités.
Correctif : mettre à jour vers 0.4.1 ou plus récent.

Package	Affected versions	Patched versions
dawnsparks-node-tesseract dawnsparks-node-tesseract_project	`= 0.4.0= 0.4.1`	No fix yet
huedawn-tesseract huedawn-tesseract_project	`= 0.3.0`	No fix yet
dawnsparks-node-tesseract npm	`< 0.4.1`	`0.4.1`

Description

dawnsparks-node-tesseract before 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.

NVD description

huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.

References

nvd.nist.gov/vuln/detail/CVE-2023-29566 · ADVISORY
rona-dinihari/dawnsparks-node-tesseract commit 81d1664 · WEB
omnitaint/Vulnerability-Reports · WEB
rona-dinihari/dawnsparks-node-tesseract · PACKAGE
npmjs.com/package/dawnsparks-node-tesseract · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free