Description
Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for production use. This may lead to instability and privacy violations.
Recommendation
Update the tesseract.js package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.0.19
- Patched version(s): 1.0.19
References
Could your website be exposed too?
SmartScanner can check your website for Insecure Default Configuration in tesseract.js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Insecure password handling vulnerability in Strapi - CVE-2021-46440
- Configuration Override in helmet-csp - Vulnerability
- @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys - Vulnerability
- angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend - CVE-2023-28444
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023