systeminformation@5.4.0 vulnerabilities

Advanced, lightweight system and OS information library

latest version

5.23.5
latest non vulnerable version

5.23.5
first published

9 years ago
latest version published

3 months ago
licenses detected
- MIT
  >=0
View systeminformation package health on Snyk Advisor Open this link in a new tab

Known vulnerabilities in the systeminformation package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
C Arbitrary Command Injection systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Arbitrary Command Injection via the `wifiConnections()` and `wifiNetworks()` functions. An attacker can inject malicious commands by crafting detected SSIDs. How to fix Arbitrary Command Injection? Upgrade `systeminformation` to version 5.21.7 or higher.	>=5.0.0 <5.21.7
L Improper Input Validation systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Improper Input Validation. The function versions doesn't check the input of the user, which is expected a string. `const si = require('systeminformation'); si.versions({toString : () => { console.log("This is a PoC") }});` How to fix Improper Input Validation? Upgrade `systeminformation` to version 5.6.11 or higher.	<5.6.11
M Arbitrary Command Injection systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Arbitrary Command Injection. Service parameters passed to `si.inetLatency()`, `si.inetChecksite()`, `si.services()`, and `si.processLoad()` are not sanitized properly. How to fix Arbitrary Command Injection? Upgrade `systeminformation` to version 5.6.4 or higher.	<5.6.4