GitHub Advisoryadvisory · npm

GHSA-m57p-p67h-mq74 Command Injection Vulnerability in systeminformation

MEDIUM Published 2020-12-16 Modified 2020-12-16 Official page ↗
Aliases
CVE-2020-26274
Ecosystem
npm
Packages
systeminformation
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-78
Reviewed
2020-12-16

Affected packages

• npm systeminformation: < 4.31.1 → fixed in 4.31.1

Description

Impact command injection vulnerability Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.31.1 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetLatency() For more information If you have any questions or comments about this advisory: • Open an issue in systeminformation

Related

Alias · CVE (1)

  • CVE-2020-26274 In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References