Description
npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4v2w-h9jm-mqjg
Patch, Third Party Advisory x_refsource_misc
https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016
Scores
CVSS v3
8.1
EPSS
0.0192
EPSS Percentile
77.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Details
CWE
CWE-471
CWE-78
Status
published
Products (2)
npm/systeminformation
0 - 4.30.5npm
systeminformation/systeminformation
< 4.30.5
Published
Nov 27, 2020
Tracked Since
Feb 18, 2026