CVE-2020-26274: Command Injection Vulnerability in systeminformation
Summary
CVE-2020-26274: Command Injection Vulnerability in systeminformation. Affects systeminformation versions < 4.31.1. Fixed in 4.31.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
systeminformation is an npm package that provides system information for Node.js applications. It offers various functions to retrieve data about the system, such as CPU, memory, network, and disk information. This package is vulnerable to a command injection vulnerability, which allows an attacker to execute arbitrary commands on the system.
Vulnerability Detail
The command injection vulnerability in systeminformation arises from a lack of proper input validation and sanitization in the si.inetLatency() function. An attacker can exploit this vulnerability by passing malicious input as the service parameter, which is not properly checked or sanitized. This can lead to the execution of arbitrary commands with the privileges of the user running the Node.js application. The impact of this vulnerability can range from unauthorized access to sensitive data to complete compromise of the system.
How To Fix
Latest published version: 5.33.16 as of 22 Oct 2026
npm install systeminformation@5.33.16Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.31.1
This is the first release that contains the fix.
npm install systeminformation@4.31.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not possible, it is crucial to check or sanitize the service parameter strings that are passed to the si.inetLatency() function. This can be done by validating the input against a whitelist of allowed characters or using a secure input validation library. By ensuring that only valid and safe input is accepted, the risk of command injection can be mitigated.
Conclusion
The command injection vulnerability in systeminformation can lead to serious security risks, including unauthorized access and system compromise. It is crucial to upgrade to the latest version of the package or implement proper input validation to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for systeminformation →
FAQ
systeminformation is an npm package that provides system information for Node.js applications. It offers functions to retrieve data about the system's CPU, memory, network, and disk.
A command injection vulnerability allows an attacker to execute arbitrary commands on a system by injecting malicious input into a vulnerable application. In the case of systeminformation, the vulnerability arises from improper input validation in the si.inetLatency() function.
The impact of this vulnerability can range from unauthorized access to sensitive data to complete compromise of the system. An attacker can execute arbitrary commands with the privileges of the user running the Node.js application.
To fix this vulnerability, it is recommended to upgrade to version 4.31.1 or later of the systeminformation package. This version includes a fix for the command injection vulnerability.
If upgrading is not possible, it is crucial to check or sanitize the service parameter strings that are passed to the si.inetLatency() function. This can be done by validating the input against a whitelist of allowed characters or using a secure input validation library.
References
Related vulnerabilities
Recent vulnerabilities recorded for systeminformation.
