GitHub Advisoryadvisory · npm

GHSA-4v2w-h9jm-mqjg Prototype Pollution in systeminformation

MEDIUM Published 2020-11-27 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-26245
Ecosystem
npm
Packages
systeminformation
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-471, CWE-78
Reviewed
2020-11-27

Affected packages

• npm systeminformation: < 4.30.5 → fixed in 4.30.5

Description

Impact command injection vulnerability by prototype pollution Patches Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version >= 4.30.2 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite() For more information If you have any questions or comments about this advisory: • Open an issue in systeminformation

Related

Alias · CVE (1)

  • CVE-2020-26245 npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. vulnerability

Weakness · CWE (2)

  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References