# systeminformation (npm) vulnerabilities 17 known vulnerabilities (1 critical, 12 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.33.19 (Oct 30, 2026): no advisory affects it - Newest unaffected release: 5.33.19 (Oct 30, 2026), the latest release - Weekly downloads: 26.2M - Dependents: 4,688 - Releases: 500+ since 4.22.3 (Feb 20, 2020) - Registry: https://www.npmjs.com/package/systeminformation - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116674: 4.22.3 to 5.33.12 (5.33.13 is outside it) - CVE-2026-116673: 4.22.3 to 5.33.13 (5.33.14 is outside it) - CVE-2026-116576: 4.22.3 to 5.33.15 (5.33.16 is outside it) - CVE-2026-50289: 4.22.3 to 5.31.6 (5.31.7 is outside it) - CVE-2026-44724: 4.22.3 to 5.31.5 (5.31.6 is outside it) - CVE-2026-26318: 4.22.3 to 5.30.8 (5.31.0 is outside it) - CVE-2026-26280: 4.22.3 to 5.30.7 (5.30.8 is outside it) - CVE-2025-68154: 4.22.3 to 5.27.13 (5.27.14 is outside it) - CVE-2024-56334: 4.22.3 to 5.23.6 (5.23.8 is outside it) - CVE-2023-42810: 5.0.0 to 5.21.6 (5.21.7 is outside it) - CVE-2020-26300: 4.22.3 to 4.26.1 (4.26.2 is outside it) - CVE-2021-21388: 4.22.3 to 5.6.3 (5.6.4 is outside it) - CVE-2021-21315: 4.22.3 to 5.3.0 (5.3.1 is outside it) - CVE-2020-26274: 4.22.3 to 4.31.0 (4.31.1 is outside it) - CVE-2020-26245: 4.22.3 to 4.30.4 (4.30.5 is outside it) - CVE-2020-7778: 4.22.3 to 4.30.1 (4.30.2 is outside it) - CVE-2020-7752: 4.22.3 to 4.27.10 (4.27.11 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (17) ### [CVE-2026-116674](https://cve.now/CVE-2026-116674): systeminformation: Prototype pollution in \`networkStats()\` via the interface name - Severity: Medium 6.5 - Published: Oct 27, 2026 - Affected: fixed in 5.33.13. - Fixed in 5.33.13 (released Sep 20, 2026, 37 days before disclosure). - The latest release, 5.33.19, is not affected. - 48% of systeminformation downloads last week were affected versions (13.8M). ### [CVE-2026-116673](https://cve.now/CVE-2026-116673): systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net - Severity: Low 3.3 - Published: Oct 27, 2026 - Affected: fixed in 5.33.14. - Fixed in 5.33.14 (released Sep 28, 2026, 29 days before disclosure). - The latest release, 5.33.19, is not affected. - 51% of systeminformation downloads last week were affected versions (14.7M). ### [CVE-2026-116576](https://cve.now/CVE-2026-116576): systeminformation: Windows command injection in services() through Unicode quotation marks - Severity: High 7.8 - Published: Oct 26, 2026 - Affected: fixed in 5.33.16. - Fixed in 5.33.16 (released Oct 19, 2026, 7 days before disclosure). - The latest release, 5.33.19, is not affected. - 60% of systeminformation downloads last week were affected versions (17.2M). ### [CVE-2026-50289](https://cve.now/CVE-2026-50289): systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux - Severity: High 8.7 - Published: Jul 17, 2026 - Affected: fixed in 5.31.7. - Fixed in 5.31.7 (released May 29, 2026, 49 days before disclosure). - The latest release, 5.33.19, is not affected. - 12% of systeminformation downloads last week were affected versions (3.3M). ### [CVE-2026-44724](https://cve.now/CVE-2026-44724): systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name - Severity: High 7.8 - Published: May 27, 2026 - Affected: from 4.17.0, fixed in 5.31.6. - Fixed in 5.31.6 (released May 7, 2026, 20 days before disclosure). - The latest release, 5.33.19, is not affected. - 10% of systeminformation downloads last week were affected versions (3M). ### [CVE-2026-26318](https://cve.now/CVE-2026-26318): systeminformation has Command Injection via Unsanitized \`locate\` Output in \`versions()\` - Severity: High 8.8 - Published: Feb 19, 2026 - Affected: fixed in 5.31.0. - Fixed in 5.31.0 (released Feb 15, 2026, 4 days before disclosure). - The latest release, 5.33.19, is not affected. - 8.1% of systeminformation downloads last week were affected versions (2.3M). ### [CVE-2026-26280](https://cve.now/CVE-2026-26280): Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path - Severity: High 8.4 - Published: Feb 19, 2026 - Affected: fixed in 5.30.8. - Fixed in 5.30.8 (released Feb 14, 2026, 5 days before disclosure). - The latest release, 5.33.19, is not affected. - 8% of systeminformation downloads last week were affected versions (2.3M). ### [CVE-2025-68154](https://cve.now/CVE-2025-68154): Command Injection in fsSize() on Windows - Severity: High 8.1 - Published: Dec 16, 2025 - Affected: fixed in 5.27.14. - Fixed in 5.27.14 (released Dec 16, 2025, the day of disclosure). - The latest release, 5.33.19, is not affected. - 7.4% of systeminformation downloads last week were affected versions (2.1M). ### [CVE-2024-56334](https://cve.now/CVE-2024-56334): Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation - Severity: High 7.8 - Published: Dec 20, 2024 - Affected: fixed in 5.23.7. - Fixed in 5.23.8 (released Dec 10, 2024, 10 days before disclosure, the advisory names 5.23.7, which was never published). - The latest release, 5.33.19, is not affected. - 1.1% of systeminformation downloads last week were affected versions (326.4K). ### [CVE-2023-42810](https://cve.now/CVE-2023-42810): systeminformation SSID Command Injection Vulnerability - Severity: Critical 9.8 - Published: Sep 21, 2023 - Affected: from 5.0.0, fixed in 5.21.7. - Fixed in 5.21.7 (released Sep 19, 2023, 2 days before disclosure). - The latest release, 5.33.19, is not affected. - 0.4% of systeminformation downloads last week were affected versions (114.7K). ### [CVE-2020-26300](https://cve.now/CVE-2020-26300): Command injection in systeminformation - Severity: Medium 5.9 - Published: Sep 9, 2021 - Affected: fixed in 4.26.2. - Fixed in 4.26.2 (released May 19, 2020, 478 days before disclosure). - The latest release, 5.33.19, is not affected. - <0.1% of systeminformation downloads last week were affected versions (17.4K). ### [CVE-2021-21388](https://cve.now/CVE-2021-21388): Command Injection Vulnerability in systeminformation - Severity: High 8.9 - Published: Apr 29, 2021 - Affected: fixed in 5.6.4. - Fixed in 5.6.4 (released Mar 15, 2021, 45 days before disclosure). - The latest release, 5.33.19, is not affected. - 0.1% of systeminformation downloads last week were affected versions (39.2K). ### [CVE-2021-21315](https://cve.now/CVE-2021-21315): Command Injection Vulnerability - Severity: High 7.1 ยท KEV - Published: Feb 16, 2021 - Affected: fixed in 5.3.1. - Fixed in 5.3.1 (released Feb 14, 2021, 2 days before disclosure). - The latest release, 5.33.19, is not affected. - 0.1% of systeminformation downloads last week were affected versions (38.8K). ### [CVE-2020-26274](https://cve.now/CVE-2020-26274): Command Injection Vulnerability in systeminformation - Severity: Medium 6.4 - Published: Dec 16, 2020 - Affected: fixed in 4.31.1. - Fixed in 4.31.1 (released Dec 11, 2020, 5 days before disclosure). - The latest release, 5.33.19, is not affected. - <0.1% of systeminformation downloads last week were affected versions (21.2K). ### [CVE-2020-26245](https://cve.now/CVE-2020-26245): Prototype Pollution leading to Command Injection in systeminformation - Severity: High 8.1 - Published: Nov 27, 2020 - Affected: fixed in 4.30.5. - Fixed in 4.30.5 (released Nov 26, 2020, 1 day before disclosure). - The latest release, 5.33.19, is not affected. - <0.1% of systeminformation downloads last week were affected versions (20.9K). ### [CVE-2020-7778](https://cve.now/CVE-2020-7778): Prototype Pollution - Severity: High 7.3 - Published: Nov 26, 2020 - Affected: fixed in 4.30.2. - Fixed in 4.30.2 (released Nov 25, 2020, 1 day before disclosure). - The latest release, 5.33.19, is not affected. - <0.1% of systeminformation downloads last week were affected versions (20.6K). ### [CVE-2020-7752](https://cve.now/CVE-2020-7752): Command Injection - Severity: High 8.8 - Published: Oct 26, 2020 - Affected: fixed in 4.27.11. - Fixed in 4.27.11 (released Oct 26, 2020, the day of disclosure). - The latest release, 5.33.19, is not affected. - <0.1% of systeminformation downloads last week were affected versions (19.7K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/systeminformation Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.