~ / search / GHSA-fj59-f6c3-3vw4

GHSA-fj59-f6c3-3vw4

Command Injection in systeminformation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-26300

Packages

EcosystemPackageAffectedFixed in
npm systeminformation < 4.26.2 4.26.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact command injection vulnerability ### Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2 ### Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to `is.services()`, `is.inetChecksite()`, `si.inetLatency()`, `si.networkStats()`, `is.services()` and `si.processLoad()` ### References _Are there any links users can visit to find out more?_ ### For more information If you have any questions or comments about this advisory: * Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation)

References

External links from the advisory. They lead to third-party sites.