GHSA-wphj-fx3q-84ch
High · 8.1CVSS
8.1
EPSS
—
Published
Dec 16, 2025
CISA due date
—
The record
systeminformation has a Command Injection vulnerability in fsSize() function on Windows
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | systeminformation | 0 | 5.27.14 |
| Chainguard | kibana-8.18 | 0 | 0 |
| Chainguard | kibana-8.18-bitnami | 0 | 0 |
| Chainguard | kibana-8.18-iamguarded | 0 | 0 |
| Chainguard | kibana-8.19 | 0 | 0 |
| Chainguard | kibana-8.19-bitnami | 0 | 0 |
| Chainguard | kibana-8.19-iamguarded | 0 | 0 |
| Chainguard | kibana-9.0 | 0 | 0 |
| Chainguard | kibana-9.0-bitnami | 0 | 0 |
| Chainguard | kibana-9.0-iamguarded | 0 | 0 |
| Chainguard | kibana-9.1 | 0 | 0 |
| Chainguard | kibana-9.1-bitnami | 0 | 0 |
| Chainguard | kibana-9.1-iamguarded | 0 | 0 |
| Chainguard | kibana-9.2 | 0 | 0 |
| Chainguard | kibana-9.2-iamguarded | 0 | 0 |
Related vulnerabilities
- CVE-2025-68154 systeminformation is a System and OS information library for node.js. Same vulnerability
- CVE-2026-44724 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- GHSA-hvx9-hwr7-wjj9 Systeminformation vulnerable to Linux command injection in networkInterfaces() via… Also affects systeminformation
- CVE-2026-26318 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- CVE-2026-26280 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- GHSA-5vv4-hvf7-2h46 Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation Also affects systeminformation
- GHSA-9c88-49p5-5ggf Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js… Also affects systeminformation
- GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__… Also affects kibana-8.18