Advisoriesby Ibistesseract.jsGHSA-83rx-c8cr-6j8q
Insecure Default Configuration in tesseract.js
Fix: upgrade to 1.0.19 or later
Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for production use. This may lead to instability and privacy violations.
Recommendation
Upgrade to version 1.0.19 or later.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tesseract.js npm | < 1.0.19 | 1.0.19 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-829