CVE-2025-68154
High · 8.1CVSS
8.1
EPSS
13.0%
Published
Dec 16, 2025
CISA due date
—
The record
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | systeminformation | 0 | 5.27.14 |
| Chainguard | kibana-8.18 | 0 | 0 |
| Chainguard | kibana-8.18-bitnami | 0 | 0 |
| Chainguard | kibana-8.18-iamguarded | 0 | 0 |
| Chainguard | kibana-8.19 | 0 | 0 |
| Chainguard | kibana-8.19-bitnami | 0 | 0 |
| Chainguard | kibana-8.19-iamguarded | 0 | 0 |
| Chainguard | kibana-9.0 | 0 | 0 |
| Chainguard | kibana-9.0-bitnami | 0 | 0 |
| Chainguard | kibana-9.0-iamguarded | 0 | 0 |
| Chainguard | kibana-9.1 | 0 | 0 |
| Chainguard | kibana-9.1-bitnami | 0 | 0 |
| Chainguard | kibana-9.1-iamguarded | 0 | 0 |
| Chainguard | kibana-9.2 | 0 | 0 |
| Chainguard | kibana-9.2-iamguarded | 0 | 0 |
Related vulnerabilities
- GHSA-wphj-fx3q-84ch systeminformation has a Command Injection vulnerability in fsSize() function on Windows Same vulnerability
- CVE-2026-44724 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- GHSA-hvx9-hwr7-wjj9 Systeminformation vulnerable to Linux command injection in networkInterfaces() via… Also affects systeminformation
- CVE-2026-26318 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- CVE-2026-26280 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- GHSA-5vv4-hvf7-2h46 Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation Also affects systeminformation
- GHSA-9c88-49p5-5ggf Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js… Also affects systeminformation
- GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__… Also affects kibana-8.18