GHSA-83rx-c8cr-6j8q
Insecure Default Configuration in tesseract.js
Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for production use. This may lead to instability and privacy violations.
Recommendation
Upgrade to version 1.0.19 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Insecure Default Configuration in tesseract.js
Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for production use. This may lead to instability and privacy violations.
Recommendation
Upgrade to version 1.0.19 or later.
- Record
GHSA-83rx-c8cr-6j8q- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-829
- Updated
- 2026-11-02
OSV
Insecure Default Configuration in tesseract.js
Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for production use. This may lead to instability and privacy violations.
Recommendation
Upgrade to version 1.0.19 or later.
- Record
GHSA-83rx-c8cr-6j8q- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-829
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tesseract.jsnpm | before 1.0.19 | 1.0.19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-83rx-c8cr-6j8q is a medium vulnerability (CVSS 5.9) in tesseract.js, published June 5, 2019. No source lists public exploit code. Fixed in tesseract.js 1.0.19.