Home

Description

systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.

PUBLISHED Reserved 2025-12-15 | Published 2025-12-16 | Updated 2025-12-17 | Assigner GitHub_M




HIGH: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

< 5.27.14
affected

References

github.com/...mation/security/advisories/GHSA-wphj-fx3q-84ch

github.com/...ommit/c52f9fd07fef42d2d8e8c66f75b42178da701c68

cve.org (CVE-2025-68154)

nvd.nist.gov (CVE-2025-68154)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.