GitHub Advisoryadvisory · npm

GHSA-8j36-q8x7-pm6q OS Command Injection in systeminformation

HIGH Published 2022-02-09 Modified 2021-04-13 Official page ↗
Aliases
CVE-2020-7778
Ecosystem
npm
Packages
systeminformation
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-78
Reviewed
2021-04-13

Affected packages

• npm systeminformation: < 4.30.2 → fixed in 4.30.2

Description

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.

Related

Alias · CVE (1)

  • CVE-2020-7778 This affects the package systeminformation before 4.30.2. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References