{"id":"GHSA-83rx-c8cr-6j8q","aliases":[],"status":"published","title":"Insecure Default Configuration in tesseract.js","description":"Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy.  Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations.\n\n\n## Recommendation\n\nUpgrade to version 1.0.19 or later.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-829"],"published":"2019-06-05T20:48:55Z","modified":"2023-01-09T05:01:39Z","fixes":[{"ecosystem":"npm","package":"tesseract.js","fixed_in":["1.0.19"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tesseract.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19"}]}]},{"source":"osv","ecosystem":"npm","package":"tesseract.js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.19"}]}]}],"references":[{"url":"https://github.com/naptha/tesseract.js/commit/679eba055f2a4271558e86beec3d1b70cae3fb28","tags":["web"]},{"url":"https://www.npmjs.com/advisories/792","tags":["web"]},{"url":"https://github.com/naptha/tesseract.js/pull/267","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-TESSERACTJS-174085","tags":["web"]},{"url":"https://github.com/advisories/GHSA-83rx-c8cr-6j8q"}],"sources":{"ghsa":[{"id":"GHSA-83rx-c8cr-6j8q","title":"Insecure Default Configuration in tesseract.js","description":"Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy.  Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations.\n\n\n## Recommendation\n\nUpgrade to version 1.0.19 or later.","status":"published","published":"2019-06-05T20:48:55Z","modified":"2023-01-09T05:01:39Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-83rx-c8cr-6j8q","title":"Insecure Default Configuration in tesseract.js","description":"Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy.  Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations.\n\n\n## Recommendation\n\nUpgrade to version 1.0.19 or later.","status":"published","published":"2019-06-05T20:48:55Z","modified":"2021-08-04T21:33:58Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T15:46:41.732368Z"}]}}