systeminformation@5.25.11

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Prototype Pollution via the networkStats interface cache key in lib/network.js. The _network object is initialized with {}, which inherits from Object.prototype. When an attacker supplies __proto__ as the network interface name, properties written to the cache key propagate to Object.prototype, polluting all plain objects in the process. This allows an attacker to set arbitrary properties on Object.prototype such as operstate and rx_bytes, enabling integrity impact and potential application crashes.

Note: Full end-to-end exploitation through the public networkStats API is only reachable on FreeBSD, OpenBSD, and NetBSD. On Linux, macOS, and Windows the call returns an empty result set and leaves Object.prototype untouched.

Upgrade systeminformation to version 5.33.13 or higher.

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Command Injection via the services() function on Windows, due to insufficient sanitization of shell strings in sanitizeShellString within lib/util.js. An attacker who controls the service name argument passed to services() can inject arbitrary PowerShell commands that are executed on the host system.

Upgrade systeminformation to version 5.33.16 or higher.

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Command Injection through the checkLinuxDCHPInterfaces() function in lib/network.js. An attacker can execute arbitrary commands by supplying a malicious source path in a Linux interfaces(5) configuration file that networkInterfaces() parses. The vulnerable code reads /etc/network/interfaces and recursively follows source directives, then interpolates the parsed path unquoted into a shell command passed to execSync(). Any process calling networkInterfaces() on a system where an attacker can influence a sourced interfaces file can be made to run injected commands with the privileges of that Node.js process.

Upgrade systeminformation to version 5.31.7 or higher.

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Command Injection in the networkInterfaces function when handling NetworkManager connection profile names obtained from nmcli device status output. An attacker can execute arbitrary shell commands with the privileges of the calling Node.js process by creating or renaming an active NetworkManager connection profile to include shell metacharacters, which are then unsafely interpolated into shell commands executed by the process.

Upgrade systeminformation to version 5.31.6 or higher.

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Command Injection via the wifiNetworks() function. Although the iface parameter is sanitized, it is passed unsanitized to execSync() when a timeout triggers a retry. An attacker can execute arbitrary operating system commands by supplying crafted input to the iface parameter.

Upgrade systeminformation to version 5.30.8 or higher.

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Command Injection via the versions() function, which executes a locate command to find a PostgreSQL installation on Linux. An attacker who can write files to the target filesystem can execute arbitrary commands with the privileges of the running process by planting a file whose name contains shell metacharacters. The attacker must have sufficient permissions to write files in directories indexed by updatedb.

Upgrade systeminformation to version 5.31.0 or higher.