Improper Input Validation Affecting systeminformation package, versions <5.6.11
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SYSTEMINFORMATION-1244526
- published 9 Apr 2021
- disclosed 9 Apr 2021
- credit Renan Rocha (EffectRenan)
How to fix?
Upgrade systeminformation to version 5.6.11 or higher.
Overview
systeminformation is a simple system and OS information library.
Affected versions of this package are vulnerable to Improper Input Validation. The function versions doesn't check the input of the user, which is expected a string.
const si = require('systeminformation');
si.versions({toString : () => { console.log("This is a PoC") }});
References
CVSS Scores
version 3.1