Command Injection Affecting systeminformation package, versions <4.31.1
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.18% (56th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SYSTEMINFORMATION-1050436
- published 14 Dec 2020
- disclosed 11 Dec 2020
- credit EffectRenan
Introduced: 11 Dec 2020
CVE-2020-26274 Open this link in a new tabHow to fix?
Upgrade systeminformation to version 4.31.1 or higher.
Overview
systeminformation is a simple system and OS information library.
Affected versions of this package are vulnerable to Command Injection. The sanitizeShellString function does not sanitize quotation marks, which could be leveraged by an attacker to execute arbitrary commands.
PoC
const si = require('systeminformation');
si.inetLatency("`<OS command>`");
References
CVSS Scores
version 3.1