8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-63705

CVE-2025-63705: node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js

NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-63705

CVE-2025-63705:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
node-ts-ocr	npm	= 1.0.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the node-ts-ocr package constructs shell commands using unsanitized user input. Specifically, the Ocr.invokeImageOcr and Ocr.invokePdfToTiff functions in src/index.ts build command strings for tesseract and convert utilities, respectively. They incorporate the imagePath and filePath parameters directly into these command strings. An attacker can provide a path containing shell metacharacters (e.g., ';', '&&', '||') to inject and execute arbitrary commands on the host system. The Ocr.extractText function is also an important indicator, as it acts as a primary entry point, calling the other vulnerable functions with the user-provided file path. The root cause is the use of child_process.exec on a command string built with concatenation instead of using safer alternatives like child_process.spawn with an argument array, which would prevent the shell from interpreting the input as commands.

Vulnerable functions

Ocr.invokeImageOcr

src/index.ts

The 'invokeImageOcr' function is vulnerable to OS command injection. It constructs a shell command by directly concatenating the 'imagePath' parameter, which is not sanitized. An attacker can provide a malicious string (e.g., 'image.tiff; id;') as 'imagePath' to execute arbitrary commands on the system. The vulnerable command is then executed via 'execAsync', which uses 'child_process.exec'.

Ocr.invokePdfToTiff

src/index.ts

The 'invokePdfToTiff' function is vulnerable to OS command injection. It includes the 'filePath' parameter within an array that is later joined to form a command string. Since 'filePath' is not sanitized, an attacker can inject shell commands. The constructed command is then executed using 'execAsync', leading to code execution.

Ocr.extractText

src/index.ts

The 'extractText' function serves as an entry point for the command injection vulnerability. It takes a 'filePath' and passes it directly to the vulnerable 'invokePdfToTiff' function. If the file is not a text-based PDF, this function will orchestrate the conversion and OCR process, triggering the underlying vulnerabilities in 'invokePdfToTiff' and 'invokeImageOcr'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.