Bumps systeminformation from 5.33.10 to 5.33.19. Release notes Sourced from systeminformation's releases. v5.33.19 Full Changelog: sebhildebrandt/systeminformation@v5.33.18...v5.33.19 v5.33.1...

A vulnerability in systeminformation's networkInterfaces() function on Linux allows attackers to execute system commands with the privileges of the.

Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.

A critical OS Command Injection (CVE-2025-68154) in the systeminformation Node.js library risks RCE on Windows. Affects 16M+ users. Upgrade to v5.27.14.

A critical security vulnerability has been discovered in the widely-used Node.js package “systeminformation,” potentially exposing millions of systems to remote code execution (RCE) attacks. The flaw, identified as CVE-2024-56334 , affects versions up to and including 5.23.6 of the package, which has over 8 million monthly downloads and a staggering 330 million total downloads. The vulnerability stems from a command injection flaw within the getWindowsIEEE8021x function, which retrieves network SSID information. This function fails to properly sanitize the SSID before passing it as a parameter to cmd.exe. As a result, an attacker could embed malicious commands within the SSID of a Wi-Fi network , which would then be executed on a vulnerable system when the getWindowsIEEE8021x function is called. 2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs ->  Download Free Guide Depending on how the package is used, this vulnerability could enable attackers to perform remote code execution or local privilege escalation. The exploitation appears to be relatively straightforward, requiring only local access to approach the attack. A proof of concept (PoC) demonstrates two potential attack scenarios: Running a ping command indefinitely by setting the SSID to: a" | ping /t 127.0.0.1 & Executing an arbitrary executable with elevated privileges by setting the SSID to: a" | %SystemDrive%\a\a.exe & Once connected to a maliciously crafted Wi-Fi network, simply calling the vulnerable function (e.g., si.networkInterfaces() ) would trigger the execution of the embedded command. The maintainers of “systeminformation” have addressed this issue in version 5.23.7. All users of this package are strongly urged to update to the latest version immediately. For developers unable to upgrade, a workaround involves manually sanitizing parameters passed to specific functions, including. si.inetLatency() , si.inetChecksite() , si.services() , and si.processLoad() . This vulnerability highlights the ongoing security challenges in the npm ecosystem and the potential risks associated with widely-used packages. It serves as a reminder for developers to: Regularly update dependencies and monitor security advisories Implement proper input sanitization, especially when dealing with system-level commands Conduct thorough security audits of third-party packages used in their projects The discovery of CVE-2024-56334 in the “systeminformation” package underscores the critical importance of maintaining vigilance in software security, particularly for widely adopted open-source libraries. As the Node.js ecosystem continues to grow, it’s crucial for both developers and organizations to prioritize security practices and stay informed about potential vulnerabilities that could impact their systems. Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN –  Try for Free The post Node.js “systeminformation” Vulnerability Exposes Millions of Systems to RCE Attacks appeared first on Cyber Security News .

Node.jsライブラリ「systeminformation」のfsSize関数には、OSコマンドインジェクションの脆弱性（CVE-2025-68154）があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

CVE-2025-68154: systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated in...

Fastfetch gathers information about your computer's operating system, software, and hardware, and then displays it in an easy-to-read way.

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null …

systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches …

🛡 <b>CVE-2026-26280</b> <b>CVSS:</b> 8.4 — <b>High</b> <b>Status:</b> Analyzed <b>Source:</b> security-advisories@github.com systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue. 🔗 <b>References</b> • <a href="https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460">https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460</a> • <a href="https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf">https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf</a> 📅 Feb 19, 2026

🛡 <b>CVE-2026-26318</b> <b>CVSS:</b> 8.8 — <b>High</b> <b>Status:</b> Analyzed <b>Source:</b> security-advisories@github.com systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue. 🔗 <b>References</b> • <a href="https://github.com/sebhildebrandt/systeminformation/commit/b67d3715eec881038ccbaace2f2711419ac3e107">https://github.com/sebhildebrandt/systeminformation/commit/b67d3715eec881038ccbaace2f2711419ac3e107</a> • <a href="https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5vv4-hvf7-2h46">https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5vv4-hvf7-2h46</a> 📅 Feb 19, 2026

@da_wamwoowam: hey @discord wtf are you doing here @discord oh my fucking god it's using a library called systeminformation that calls powershell like "Get-WmiObject Win32_logicaldisk | select Access,...