Skip to main content
cve.nowby Sazabi
← npm
npmPackage

systeminformation

17 known vulnerabilities (1 critical, 12 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
5.33.19 (Oct 30, 2026): no advisory affects it
Newest unaffected release
5.33.19 (Oct 30, 2026), the latest release
Advisories
17 · 1 critical, 12 high, 3 medium, 1 low
Weekly downloads
26.2M
Dependents
4,688
Releases
500+ since 4.22.3 (Feb 20, 2020)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 17 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 17

  • CVE-2026-116674Medium 6.5

    systeminformation: Prototype pollution in `networkStats()` via the interface name

    Affected: fixed in 5.33.13.

    Fixed in 5.33.13 (released Sep 20, 2026, 37 days before disclosure).

    The latest release, 5.33.19, is not affected.

    48% of systeminformation downloads last week were affected versions (13.8M).

  • systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

    Affected: fixed in 5.33.14.

    Fixed in 5.33.14 (released Sep 28, 2026, 29 days before disclosure).

    The latest release, 5.33.19, is not affected.

    51% of systeminformation downloads last week were affected versions (14.7M).

  • systeminformation: Windows command injection in services() through Unicode quotation marks

    Affected: fixed in 5.33.16.

    Fixed in 5.33.16 (released Oct 19, 2026, 7 days before disclosure).

    The latest release, 5.33.19, is not affected.

    60% of systeminformation downloads last week were affected versions (17.2M).

  • systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

    Affected: fixed in 5.31.7.

    Fixed in 5.31.7 (released May 29, 2026, 49 days before disclosure).

    The latest release, 5.33.19, is not affected.

    12% of systeminformation downloads last week were affected versions (3.3M).

  • systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

    Affected: from 4.17.0, fixed in 5.31.6.

    Fixed in 5.31.6 (released May 7, 2026, 20 days before disclosure).

    The latest release, 5.33.19, is not affected.

    10% of systeminformation downloads last week were affected versions (3M).

  • systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`

    Affected: fixed in 5.31.0.

    Fixed in 5.31.0 (released Feb 15, 2026, 4 days before disclosure).

    The latest release, 5.33.19, is not affected.

    8.1% of systeminformation downloads last week were affected versions (2.3M).

  • Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

    Affected: fixed in 5.30.8.

    Fixed in 5.30.8 (released Feb 14, 2026, 5 days before disclosure).

    The latest release, 5.33.19, is not affected.

    8% of systeminformation downloads last week were affected versions (2.3M).

  • Command Injection in fsSize() on Windows

    Affected: fixed in 5.27.14.

    Fixed in 5.27.14 (released Dec 16, 2025, the day of disclosure).

    The latest release, 5.33.19, is not affected.

    7.4% of systeminformation downloads last week were affected versions (2.1M).

  • Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation

    Affected: fixed in 5.23.7.

    Fixed in 5.23.8 (released Dec 10, 2024, 10 days before disclosure, the advisory names 5.23.7, which was never published).

    The latest release, 5.33.19, is not affected.

    1.1% of systeminformation downloads last week were affected versions (326.4K).

  • CVE-2023-42810Critical 9.8

    systeminformation SSID Command Injection Vulnerability

    Affected: from 5.0.0, fixed in 5.21.7.

    Fixed in 5.21.7 (released Sep 19, 2023, 2 days before disclosure).

    The latest release, 5.33.19, is not affected.

    0.4% of systeminformation downloads last week were affected versions (114.7K).

  • CVE-2020-26300Medium 5.9

    Command injection in systeminformation

    Affected: fixed in 4.26.2.

    Fixed in 4.26.2 (released May 19, 2020, 478 days before disclosure).

    The latest release, 5.33.19, is not affected.

    <0.1% of systeminformation downloads last week were affected versions (17.4K).

  • Command Injection Vulnerability in systeminformation

    Affected: fixed in 5.6.4.

    Fixed in 5.6.4 (released Mar 15, 2021, 45 days before disclosure).

    The latest release, 5.33.19, is not affected.

    0.1% of systeminformation downloads last week were affected versions (39.2K).

  • CVE-2021-21315High 7.1 · KEV

    Command Injection Vulnerability

    Affected: fixed in 5.3.1.

    Fixed in 5.3.1 (released Feb 14, 2021, 2 days before disclosure).

    The latest release, 5.33.19, is not affected.

    0.1% of systeminformation downloads last week were affected versions (38.8K).

  • CVE-2020-26274Medium 6.4

    Command Injection Vulnerability in systeminformation

    Affected: fixed in 4.31.1.

    Fixed in 4.31.1 (released Dec 11, 2020, 5 days before disclosure).

    The latest release, 5.33.19, is not affected.

    <0.1% of systeminformation downloads last week were affected versions (21.2K).

  • Prototype Pollution leading to Command Injection in systeminformation

    Affected: fixed in 4.30.5.

    Fixed in 4.30.5 (released Nov 26, 2020, 1 day before disclosure).

    The latest release, 5.33.19, is not affected.

    <0.1% of systeminformation downloads last week were affected versions (20.9K).

Show all 17 advisoriesShow fewer advisories

  • Prototype Pollution

    Affected: fixed in 4.30.2.

    Fixed in 4.30.2 (released Nov 25, 2020, 1 day before disclosure).

    The latest release, 5.33.19, is not affected.

    <0.1% of systeminformation downloads last week were affected versions (20.6K).

  • Command Injection

    Affected: fixed in 4.27.11.

    Fixed in 4.27.11 (released Oct 26, 2020, the day of disclosure).

    The latest release, 5.33.19, is not affected.

    <0.1% of systeminformation downloads last week were affected versions (19.7K).