CVE-2020-26300: Command Injection in systeminformation
Summary
CVE-2020-26300: Command Injection in systeminformation. Affects systeminformation versions < 4.26.2. Fixed in 4.26.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The systeminformation package is an npm package that provides a simple way to gather system information such as CPU, memory, disk, network, and process details. It is widely used in various applications to retrieve and display system information. However, a command injection vulnerability has been discovered in versions prior to 4.26.2.
Vulnerability Detail
The vulnerability allows an attacker to execute arbitrary commands on the host system by injecting malicious input into the service parameter strings passed to certain functions in the systeminformation package. This can lead to unauthorized access, data leakage, or even complete compromise of the host system. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Latest published version: 5.33.16 as of 22 Oct 2026
npm install systeminformation@5.33.16Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.26.2
This is the first release that contains the fix.
npm install systeminformation@4.26.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not possible, it is important to sanitize or check the service parameter strings that are passed to the following functions: is.services(), is.inetChecksite(), si.inetLatency(), si.networkStats(), is.services(), and si.processLoad(). Ensure that the input is properly validated and does not allow for command injection.
Conclusion
In conclusion, the systeminformation package prior to version 4.26.2 is vulnerable to command injection. It is crucial to upgrade to the latest version or implement proper input validation and sanitization to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for systeminformation →
FAQ
The vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data leakage, or complete compromise of the system.
Upgrade to version 4.26.2 or later of the systeminformation package. If upgrading is not possible, sanitize or check the service parameter strings passed to the affected functions to prevent command injection.
If upgrading is not possible, ensure proper validation and sanitization of the service parameter strings passed to the affected functions to prevent command injection.
You can find more information about this vulnerability in the systeminformation package's advisory on GitHub: https://github.com/sebhildebrandt/systeminformation
The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for systeminformation.
