Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-50289

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.

CVSS 4.0 · 8.7 High EPSS 2.2% KEV · Not listed
Vendors
Sebhildebrandt Systeminformation
Products
Systeminformation Systeminformation
CVE-2026-26318

systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`

systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Sebhildebrandt Systeminformation
Products
Systeminformation Systeminformation
CVE-2026-26280

Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.

CVSS 3.1 · 8.4 High EPSS 1.4% KEV · Not listed
Vendors
Sebhildebrandt Systeminformation
Products
Systeminformation Systeminformation
CVE-2025-68154

Command Injection in fsSize() on Windows

systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.

CVSS 3.1 · 8.1 High EPSS 13.0% KEV · Not listed
Vendors
Microsoft Systeminformation
Products
Windows Systeminformation
CVE-2021-21315

Command Injection Vulnerability

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

CVSS 3.1 · 7.1 High EPSS 90.7% KEV · Listed
Vendors
Apache Systeminformation
Products
Cordova Systeminformation
CVE-2023-42810

systeminformation SSID Command Injection Vulnerability

systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation
CVE-2021-21388

Command Injection Vulnerability in systeminformation

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.

CVSS 3.1 · 8.9 High EPSS 1.9% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation
CVE-2020-7778

Prototype Pollution

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.

CVSS 3.1 · 7.3 High EPSS 2.4% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation
CVE-2020-7752

Command Injection

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.

CVSS 3.1 · 8.8 High EPSS 6.7% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation
CVE-2020-26300

Command injection in systeminformation

systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.

CVSS 3.1 · 5.9 Medium EPSS 1.4% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation
CVE-2020-26274

Command Injection Vulnerability in systeminformation

In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.

CVSS 3.1 · 6.4 Medium EPSS 2.7% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation
CVE-2020-26245

Prototype Pollution leading to Command Injection in systeminformation

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().

CVSS 3.1 · 8.1 High EPSS 2.2% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation