GHSA-4v2w-h9jm-mqjg
Prototype Pollution in systeminformation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | systeminformation | < 4.30.5 | 4.30.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
command injection vulnerability by prototype pollution
### Patches
Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version >= 4.30.2
### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)
References
External links from the advisory. They lead to third-party sites.