Vulnerabilities

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.

systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.

systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.

systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).

systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.

The systeminformation npm package, a widely used Node.js library for retrieving hardware, system, and OS details, contains a command injection flaw (CWE-78) in versions before 5.3.1. The flaw is triggered when untrusted, user-controlled parameters are passed to functions such as si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), allowing injected commands to be executed by the underlying operating system. A successful attacker gains the ability to run arbitrary commands with the privileges of the Node.js process on the affected host, potentially enabling further compromise. Any application or service built on the npm package that forwards attacker-influenced input into these functions is affected, including deployments where the library is bundled into other products (e.g., Apache Cordova applications per the CPE data). The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-01-18, indicating exploitation in the wild, and its EPSS score of 90.7% places it in the top percentile for near-term exploitation probability.

Do: Upgrade the systeminformation npm package to version 5.3.1 or later wherever it appears in your Node.js dependency trees. If upgrading is not immediately possible, sanitize all parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), accepting only plain strings and rejecting arrays. Audit internet-facing Node.js applications (including any Cordova-packaged deployments) for use of these functions and confirm they are patched, per the CISA KEV required action.

In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.