OS Command Injection in systeminformation

Description

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.

Recommendation

Update the systeminformation package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.30.2
• Patched version(s): 4.30.2

References

• GHSA-8j36-q8x7-pm6q
• snyk.io
• CVE-2020-7778
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype Pollution in systeminformation - CVE-2020-26245
• seajs Cross-site Scripting vulnerability - CVE-2024-51091
• Deserialization of Untrusted Data in bson - CVE-2020-7610
• Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID) - CVE-2024-56334

Tags:

npm

systeminformation