CVE-2026-116576
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In systeminformation prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after sanitizeShellString(). On Windows the sanitizer removes ASCII quotes but permits Unicode quotation marks PowerShell accepts as delimiters, allowing crafted input to terminate the filter and inject a PowerShell expression executed by util.powerShell() with the Node.js process account's permissions.
Risk Assessment
The injected command may read or change accessible files, alter application data, or disrupt the service; reachability depends on whether a consuming application forwards attacker-controlled input to services() or getDynamicData().
Recommendation
Update systeminformation to version 5.33.16 or later and avoid passing untrusted input to services()/getDynamicData().
Other vulnerabilities in systeminformation
See all- CVE-2021-21315HighActively exploited
The systeminformation library for Node.js before version 5.3.1 contains a command injection vulnerability. The issue was fixed in version 5.3.1.
- CVE-2026-116674Medium
In the systeminformation library, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the _network object indexed by the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and values come from interface statistics, but name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior; fixed in version 5.33.13.
- CVE-2026-116673Low
In the systeminformation library for Node.js before 5.33.14, the Linux `networkStats(iface)` implementation uses the caller-supplied interface value in an `fs.existsSync()` check and to build `/sys/class/net/<iface>` paths without verifying it is a single interface-name segment or that the resolved path stays under `/sys/class/net`. An attacker controlling `iface` can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. This requires local filesystem setup; the issue is fixed in 5.33.14.
- CVE-2026-50289High
The systeminformation library for Node.js before version 5.31.7 is vulnerable to OS command injection via the networkInterfaces() function on Linux. The issue stems from improper handling of the source directive in network configuration files, allowing arbitrary command execution.
- CVE-2026-44724High
The systeminformation library for Node.js versions 4.17.0 to 5.31.5 is vulnerable to command injection in the networkInterfaces() function on Linux. This occurs when an active NetworkManager connection profile name contains shell metacharacters that are not properly sanitized before being used in shell commands.
- CVE-2026-26318High
The systeminformation library for Node.js prior to version 5.31.0 is vulnerable to command injection via unsanitized `locate` output in the `versions()` function. An attacker can exploit this flaw to execute arbitrary system commands.
- CVE-2026-26280High
The systeminformation library for Node.js contains a command injection vulnerability in the `wifiNetworks()` function. In the retry code path, the `iface` parameter is not sanitized, allowing an attacker to execute arbitrary OS commands.
Original NVD description (English source)
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS