Sebhildebrandt Systeminformation vulnerabilities

CVE-2021-21315 [HIGH] CWE-78 CVE-2021-21315: The System Information Library for Node.JS (npm package "systeminformation") is an open source colle The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check

CVE-2025-68154 [HIGH] CWE-78 CVE-2025-68154: systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-c

CVE-2023-42810 [CRITICAL] CWE-77 CVE-2023-42810: systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).

CVE-2020-26274 [HIGH] CWE-78 CVE-2020-26274: In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.

CVE-2021-21388 [CRITICAL] CWE-20 CVE-2021-21388: systeminformation is an open source system and OS information library for node.js. A command injecti systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service param

CVE-2020-26245 [CRITICAL] CWE-78 CVE-2020-26245: npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to s

CVE-2020-26300 [CRITICAL] CWE-77 CVE-2020-26300: systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.

CVE-2026-26318 [HIGH] CWE-78 CVE-2026-26318: systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are v systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.

CVE-2026-26280 [HIGH] CWE-78 CVE-2026-26280: systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `if

CVE-2026-44724 [HIGH] CWE-78 CVE-2026-44724: systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linu systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The libr

CVE-2024-56334 [HIGH] CWE-94 CVE-2024-56334: systeminformation is a System and OS information library for node.js. In affected versions SSIDs are systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the `getWindowsIEEE8021x` function. This means that malicious content in the SSID can be executed as OS commands. This vulnerability may enable an attacker, depending on how the pack