{"action":"No fix published. Pin and monitor.","affected":[],"component":"node-ts-ocr","cve_ids":["CVE-2025-63705"],"ecosystem":"npm","epss":0.01185,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8jh2-3mw6-6pfm","id":"tcs_01M5KFD94FJT6J9P1STF72BZE9","modified_at":"2026-05-12T17:26:29.488462Z","published_at":"2026-05-07T15:38:41Z","references":["https://osv.dev/vulnerability/GHSA-8jh2-3mw6-6pfm","https://nvd.nist.gov/vuln/detail/CVE-2025-63705","https://gist.github.com/6en6ar/a2ac44da0f4e580190be3e66cfbb9a4a","https://github.com/nicolaspearson/node.ts.ocr","https://www.npmjs.com/package/node-ts-ocr"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-8jh2-3mw6-6pfm","url":"https://osv.dev/vulnerability/GHSA-8jh2-3mw6-6pfm"}],"summary":"node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js"}