Arbitrary Command Injection Affecting systeminformation package, versions >=5.0.0 <5.21.7


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.08% (35th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-SYSTEMINFORMATION-5914637
  • published 22 Sep 2023
  • disclosed 21 Sep 2023
  • credit Unknown

How to fix?

Upgrade systeminformation to version 5.21.7 or higher.

Overview

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Arbitrary Command Injection via the wifiConnections() and wifiNetworks() functions. An attacker can inject malicious commands by crafting detected SSIDs.

Workaround

This vulnerability can be mitigated by ensuring to check or sanitize parameter strings that are passed to wifiConnections(), wifiNetworks() functions.

CVSS Scores

version 3.1
Expand this section

Snyk

9.8 critical
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

NVD

9.8 critical