CVE-2026-26832

CVE-2026-26832 is a critical OS Command Injection vulnerability (CWE-78) affecting all versions through 2.2.1 of the node-tesseract-ocr npm package. This flaw allows unauthenticated attackers to execute arbitrary operating system commands by injecting malicious input into the recognize() function's file path parameter, which is unsafely passed to child_process.exec(). With a CVSS score of 9.8 (Critical), this vulnerability has a network attack vector, low attack complexity, and results in complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or inclusion in the CISA KEV catalog, the vulnerability has received limited community discussion on social media platforms.