Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
17 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
On Windows, `systeminformation@5.33.15` builds a PowerShell command using the value passed to `services()`. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter string and run a PowerShell expression. The expression runs with the permissions of the Node.js process. This report confirms version `5.33.15`. Other package versions have not been checked. Details In `lib/processes.js`, `services()` sanitizes the caller's string with `sanitizeShellString()` and later inserts each resulting name into a `Get-CimInstance Win32_Service -Filter` command. The Windows branch passes that command to `util.powerShell()`. The sanitizer in `lib/util.js` removes the ASCII double quote, but it does not remove U+201C or U+201D, the left and right curly double quotation marks. It also permits spaces and parentheses when called in its default, non-strict mode.…
Recommended action: Upgrade to 5.33.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On Linux, `systeminformation@5.33.13` builds `/sys/class/net/ ` paths from the caller-supplied `networkStats(iface)` value without checking that the resolved path stays inside `/sys/class/net`. A caller who can create a symlink fixture and control the value passed to this API can make the function return the first line of a file readable by the Node process. Details The strict string sanitizer removes shell metacharacters but retains `/` and `.`. The Linux implementation uses this value in an `fs.existsSync('/sys/class/net/' + iface)` check and then in seven `cat` paths for interface statistics. Both operations follow `..` path components and symlinks. The code does not validate the value as an interface name or enforce resolved-path containment. The proof of concept below creates the expected statistics files in a directory writable by the unprivileged `nobody` user. Its `operstate` symlink points to a synthetic mode-0600 file under `/root`. The package call runs as…
Recommended action: Upgrade to 5.33.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
`networkStats()` keeps a per interface cache for computing `rx_sec` / `tx_sec` between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name `proto` makes every cache write land on `Object.prototype` instead of the cache, polluting every object in the Node.js process. An application is affected if it passes untrusted input as the `ifaces` argument of `si.networkStats()` and runs on FreeBSD, OpenBSD or NetBSD. Details The vulnerable code `lib/network.js` declares the cache as a plain object: ```js const _network = {}; ``` `calcNetworkSpeed()` writes into it, keyed by the interface name: ```js } else { if (!_network[iface]) { _network[iface] = {}; } _network[iface].rx_bytes = rx_bytes; _network[iface].tx_bytes = tx_bytes; _network[iface].rx_sec = null; _network[iface].tx_sec = null; _network[iface].ms = Date.now(); _network[iface].last_ms = 0; _network[iface].operstate = operstate; } ``` With…
Recommended action: Upgrade to 5.33.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On Linux, systeminformation's networkInterfaces() is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive. While collecting per-interface DHCP state, the library reads /etc/network/interfaces and, for every source <path line it encounters, extracts the path token from the file content and interpolates it unquoted into a shell command string that is run via execSync(). A source line whose path contains shell metacharacters executes arbitrary commands with the privileges of the calling Node.js process. This is the same root-cause class as the previously-fixed NetworkManager-connection-name injection in this file: a value parsed out of local system state is re-interpolated into a shell command string without sanitization. The NetworkManager paths were converted to argument-array execution, but the interfaces(5) source-recursion sink in checkLinuxDCHPInterfaces() was left unfixed and still builds a shell string. The input to this sink is…
Recommended action: Upgrade to 5.31.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. This is not caused by a caller passing attacker-controlled arguments into networkInterfaces(). The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This issue was validated locally against real NetworkManager and real nmcli. Calling only: was enough to trigger execution. The injected command ran with the privileges of the calling Node.js process. Affected Component & Versions Affected component: - lib/network.js - networkInterfaces() - Linux NetworkManager / nmcli handling Impact &…
Recommended action: Upgrade to 5.31.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Command Injection via Unsanitized locate Output in versions() — systeminformation Package: systeminformation (npm) Tested Version: 5.30.7 Affected Platform: Linux Author: Sebastian Hildebrandt Weekly Downloads: ~5,000,000+ Repository: https://github.com/sebhildebrandt/systeminformation Severity: Medium CWE: CWE-78 (OS Command Injection) --- The Vulnerable Code Path Inside the versions() function, when detecting the PostgreSQL version on Linux, the code does this: Here's what happens step by step: 1. It runs locate bin/postgres to search the filesystem for PostgreSQL binaries 2. It splits the output by newline and sorts the results alphabetically 3. It takes the last element (highest alphabetically) 4. It concatenates that path directly into a new exec() call with + ' -V' No sanitizeShellString(). No path validation. No execFile(). Raw string concatenation into exec(). The locate command reads from a system-wide database (plocate.db or mlocate.db) that indexes all filenames on the…
Recommended action: Upgrade to 5.31.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A command injection vulnerability in the wifiNetworks() function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. Details In lib/wifi.js, the wifiNetworks() function sanitizes the iface parameter on the initial call (line 437). However, when the initial scan returns empty results, a setTimeout retry (lines 440-441) calls getWifiNetworkListIw(iface) with the original unsanitized iface value, which is passed directly to execSync('iwlist ${iface} scan'). PoC 1. Install systeminformation@5.30.7 2. Call si.wifiNetworks('eth0; id') 3. The first call sanitizes input, but if results are empty, the retry executes: iwlist eth0; id scan Impact Remote Code Execution (RCE). Any application passing user-controlled input to si.wifiNetworks() is vulnerable to arbitrary command execution with the privileges of the Node.js process.
Recommended action: Upgrade to 5.30.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The fsSize() function in systeminformation is vulnerable to OS Command Injection (CWE-78) on Windows systems. The optional drive parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. Affected Platforms: Windows only CVSS Breakdown: - Attack Vector (AV:N): Network - if used in a web application/API - Attack Complexity (AC:H): High - requires application to pass user input to fsSize() - Privileges Required (PR:N): None - no authentication required at library level - User Interaction (UI:N): None - Scope (S:U): Unchanged - executes within Node.js process context - Confidentiality/Integrity/Availability (C:H/I:H/A:H): High impact if exploited Note: The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to fsSize(), it is not vulnerable. --- Details Vulnerable Code Location File:…
Recommended action: Upgrade to 5.27.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SSID is not sanitized when before it is passed as a parameter to cmd.exe in the getWindowsIEEE8021x function. This means that malicious content in the SSID can be executed as OS commands. Details I have exploited this vulnerability in a Windows service using version 5.22.11 of the module, to escalate privileges (in an environment where I am authorized to do so). However, as far as I can see from the code, it is still present in master branch at time of writing, on line 403/404 of network.js. The SSID is obtained from netsh wlan show interface ... in getWindowsWirelessIfaceSSID, and then passed to cmd.exe /d /s /c "netsh wlan show profiles ... in getWindowsIEEE8021x, without sanitization. PoC First, the command injection payload should be included in the connected Wi-Fi SSID. For example create hotspot on mobile phone or other laptop, set SSID to payload, connect to it with victim Windows system. Two example SSID's to demonstrate exploitation are below. Demonstration to…
Recommended action: Upgrade to 5.23.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact SSID Command Injection Vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version = 5.21.7, Version 4 was not affected Workarounds If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to wifiConnections(), wifiNetworks() (string only) References See also https://systeminformation.io/security.html
Recommended action: Upgrade to 5.21.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Recommended action: Upgrade to 4.30.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact command injection vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version = 5.6.4 Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Recommended action: Upgrade to 5.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact command injection vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version = 5.3.1 Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Recommended action: Upgrade to 5.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact command injection vulnerability Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version = 4.31.1 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetLatency() For more information If you have any questions or comments about this advisory: Open an issue in systeminformation
Recommended action: Upgrade to 4.31.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact command injection vulnerability by prototype pollution Patches Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version = 4.30.2 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite() For more information If you have any questions or comments about this advisory: Open an issue in systeminformation
Recommended action: Upgrade to 4.30.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact command injection vulnerability Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version = 4.26.2 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to is.services(), is.inetChecksite(), si.inetLatency(), si.networkStats(), is.services() and si.processLoad() References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open an issue in systeminformation
Recommended action: Upgrade to 4.26.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact command injection vulnerability Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version = 4.27.11 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite() References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open an issue in systeminformation
Recommended action: Upgrade to 4.27.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.