Cloudanix VulnDB

CVE-2026-116576

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a system information tool for Node.js lets attackers who can supply certain input run their own commands on Windows computers, potentially stealing or changing files.

Chainable
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Library
Class
Command Injection
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Command injection in services() via incomplete sanitization of Unicode quotes in PowerShell filter construction on Windows, allowing arbitrary expression execution under the Node.js process account.

Why it matters to the business

Attackers who can supply input to affected functions may read or alter files, modify application data, or disrupt services on Windows systems using the library.

How an attack unfolds

An attacker supplies a crafted service name containing Unicode quotation marks to services() or getDynamicData(). The sanitizer strips ASCII quotes but leaves the Unicode delimiters intact, so PowerShell treats the injected content as a separate expression that executes when util.powerShell() runs the command.

How to fix it

Upgrade systeminformation to version 5.33.16 or later. Review all call sites that forward untrusted input to services() or getDynamicData() and apply additional input validation or avoid direct use of the affected functions on Windows.

How to confirm the fix worked

Confirm the installed version is at least 5.33.16. Test by passing a service name containing Unicode quotation marks and verifying the injected expression is no longer executed.

Typical attack path

  1. Identify a consuming application that passes attacker-controlled values to services() or getDynamicData()
  2. Craft a service name containing Unicode left/right double quotation marks around a terminating filter and injected PowerShell expression
  3. Submit the payload through the application input path
  4. PowerShell executes the injected expression with the privileges of the Node.js process

How to detect it

Monitor process creation logs for Node.js spawning PowerShell with unusual Get-CimInstance filter arguments containing non-ASCII quotation characters or unexpected expressions. Review application logs for service name parameters that include quotation marks.

What your security team should do

  • Upgrade to 5.33.16 immediately on all Windows deployments
  • Audit application code for direct or indirect calls to the affected functions with untrusted data
  • Implement compensating controls such as strict allow-listing of service names until upgrade is complete

The record

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities