systeminformation has a Command Injection vulnerability in fsSize() function on Windows

Description

The fsSize() function in systeminformation is vulnerable to OS Command Injection (CWE-78) on Windows systems. The optional drive parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function.

Recommendation

Update the systeminformation package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.27.14
• Patched version(s): 5.27.14

References

• GHSA-wphj-fx3q-84ch
• CVE-2025-68154
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• CouchAuth has a Server-Side Template Injection vulnerability in its email functionality - CVE-2024-57177
• Command Injection Vulnerability - CVE-2021-21315
• Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID) - CVE-2024-56334
• Unauthenticated Denial of Service in the octokit/webhooks library (GHSA-pwfr-8pq7-x9qv) - CVE-2023-50728

Tags:

npm

systeminformation