systeminformation: Windows command injection in services() through Unicode quotation marks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.33.16
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The systeminformation Node.js library, used for retrieving system and OS information, is affected on Windows when its services() function receives attacker-controlled service names. Malicious input can run arbitrary PowerShell commands with the permissions of the Node.js process, potentially reading or modifying files, altering application data, or disrupting services.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- sebhildebrandt systeminformation
fixed in 5.33.16
- systeminformationnpm
fixed in 5.33.16