{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adesmondmorrisnode_tesseract/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:desmondmorris:node_tesseract:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-117511"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["node-tesseract (\u003c= 0.2.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["desmondmorris"],"content_html":"\u003cp\u003eA vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. The process function in lib/tesseract.js, part of the Command Builder component, is affected by OS command injection through manipulation of the image argument. The attack can be executed remotely. The exploit has been disclosed to the public, and the project has not responded to an early issue report.\u003c/p\u003e\n","date_modified":"2026-10-27T18:01:51Z","date_published":"2026-10-27T18:01:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-node-tesseract-rce/","summary":"A vulnerability exists in desmondmorris node-tesseract up to 0.2.7 where the process function in lib/tesseract.js is susceptible to OS command injection via the image argument.","title":"node-tesseract: OS command injection in lib/tesseract.js (CVE-2026-117511)","url":"https://feed.craftedsignal.io/briefs/2026-10-node-tesseract-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:desmondmorris:node_tesseract:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}