Skip to content

Command Injection in systeminformation

Moderate severity GitHub Reviewed Published Oct 26, 2020 in sebhildebrandt/systeminformation • Updated Feb 1, 2023

Package

npm systeminformation (npm)

Affected versions

< 4.26.2

Patched versions

4.26.2

Description

Impact

command injection vulnerability

Patches

Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2

Workarounds

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to is.services(), is.inetChecksite(), si.inetLatency(), si.networkStats(), is.services() and si.processLoad()

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

References

Reviewed Oct 27, 2020
Published to the GitHub Advisory Database Oct 27, 2020
Published by the National Vulnerability Database Sep 9, 2021
Last updated Feb 1, 2023

Severity

Moderate
5.9
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses

CVE ID

CVE-2020-26300

GHSA ID

GHSA-fj59-f6c3-3vw4
Checking history
See something to contribute? Suggest improvements for this vulnerability.