GitHub Advisoryadvisory · npm

GHSA-fj59-f6c3-3vw4 Command Injection in systeminformation

MEDIUM Published 2020-10-27 Modified 2021-09-10 Official page ↗
Aliases
CVE-2020-26300
Ecosystem
npm
Packages
systeminformation
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-78
Reviewed
2020-10-27

Affected packages

• npm systeminformation: < 4.26.2 → fixed in 4.26.2

Description

Impact command injection vulnerability Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to `is.services()`, `is.inetChecksite()`, `si.inetLatency()`, `si.networkStats()`, `is.services()` and `si.processLoad()` References _Are there any links users can visit to find out more?_ For more information If you have any questions or comments about this advisory: • Open an issue in systeminformation

Related

Alias · CVE (1)

  • CVE-2020-26300 systeminformation is an npm package that provides system and OS information library for node.js. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References