CVE-2020-26245: Prototype Pollution in systeminformation
Summary
CVE-2020-26245: Prototype Pollution in systeminformation. Affects systeminformation versions < 4.30.5. Fixed in 4.30.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The systeminformation package is an npm package that provides a simple way to gather system information such as CPU, memory, disk, and network usage. It is widely used in Node.js applications to retrieve and display system information. However, an instance of prototype pollution vulnerability has been identified in the package.
Vulnerability Detail
The vulnerability in systeminformation is a command injection vulnerability caused by prototype pollution. This type of vulnerability occurs when an attacker is able to inject or modify properties of existing objects, leading to unexpected behavior or code execution. In this case, the vulnerability allows an attacker to inject malicious commands into the service parameter strings passed to the si.inetChecksite() function. If the input is not properly sanitized or validated, an attacker can execute arbitrary commands on the system. The impact of this vulnerability can range from unauthorized access to sensitive information to complete system compromise.
How To Fix
Latest published version: 5.33.16 as of 22 Oct 2026
npm install systeminformation@5.33.16Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.30.5
This is the first release that contains the fix.
npm install systeminformation@4.30.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not possible, it is crucial to manually check or sanitize the service parameter strings that are passed to the si.inetChecksite() function. This can be done by implementing proper input validation and sanitization techniques to ensure that only valid and safe input is processed by the function.
Conclusion
The prototype pollution vulnerability in the systeminformation package can be mitigated by upgrading to the fixed version or implementing proper input validation and sanitization techniques. It is crucial to take action to prevent potential command injection attacks and protect the system from unauthorized access or compromise. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for systeminformation →
FAQ
Prototype pollution is a vulnerability that allows an attacker to inject or modify properties of existing objects, leading to unexpected behavior or code execution.
The impact of this vulnerability can range from unauthorized access to sensitive information to complete system compromise, depending on the attacker's intentions and the system's configuration.
To fix this vulnerability, it is recommended to upgrade to version 4.30.2 or later of the systeminformation package. Alternatively, you can manually sanitize the input passed to the vulnerable function to prevent command injection.
If upgrading to the fixed version is not possible, you can implement input validation and sanitization techniques to ensure that only safe input is processed by the vulnerable function.
For more information, you can open an issue in the systeminformation GitHub repository: https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md
References
Related vulnerabilities
Recent vulnerabilities recorded for systeminformation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
