CVE-2023-29566

huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.16% chance of exploitation in the next 30 days, 82nd percentile

Published

2023-04-24

Updated

2025-02-04

Proof-of-concept exploits (1)

• omnitaint/Vulnerability-Reports/blob/ec3645003c7f8996459b5b24c722474adc2d599f/reports/daw…0★ · 2023-05-23

Security advisories

• advisories/GHSA-88qf-5f3v-pm6m
• rona-dinihari/dawnsparks-node-tesseract/commit/81d1664f0b9fe521534acfae1d5b9c40127b36c1
• https://www.npmjs.com/package/dawnsparks-node-tesseract

References

• CVE Record
• NVD entry

Related

• CVE-2023-27848
• CVE-2023-27849