An OS command injection vulnerability in the node-ts-ocr NPM package allows authenticated attackers to execute arbitrary system commands.

This is an OS Command Injection flaw located in the invokeImageOcr function within src/index.js, requiring low privileges to exploit via network vectors.

A successful exploit allows attackers to execute arbitrary operating system commands with the privileges of the running Node.js process, leading to complete system compromise, data theft, or lateral movement. The high CVSS score of 8.8 reflects the severe impact on confidentiality, integrity, and availability.

Immediate Action: Review the application dependencies and isolate or remove the vulnerable node-ts-ocr package until a security update is released by the maintainers.

Proactive Monitoring: Monitor server logs for anomalous process execution, unexpected child processes spawned by Node.js, and unauthorized file modifications.

Compensating Controls: Implement strict input sanitization and execute the Node.js application within a restricted container or sandbox environment to limit the impact of command execution.

Public Exploit Available: Yes, a published PoC exists, as evidenced by the reference write-up on GitHub.

Organizations utilizing the node-ts-ocr package must assess their exposure immediately and remove the vulnerable library from their codebases. Given the critical nature of command injection flaws, prompt code refactoring and defensive dependency management are required to mitigate risk.