CVE-2020-7752: Command Injection Vulnerability in systeminformation
Summary
CVE-2020-7752: systeminformation command injection vulnerability. Affects systeminformation versions < 4.27.11. Fixed in 4.27.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
systeminformation is an npm package that provides a simple way to gather system information in Node.js applications. It offers various functions to retrieve data about the operating system, CPU, memory, network, and more. Unfortunately, an unpatched version of systeminformation is vulnerable to a command injection attack.
Vulnerability Detail
The command injection vulnerability in systeminformation allows an attacker to execute arbitrary commands on the host system by injecting malicious code through the service parameter strings passed to si.inetChecksite(). This can lead to unauthorized access, data leakage, and potential compromise of the entire system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 5.33.16 as of 22 Oct 2026
npm install systeminformation@5.33.16Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.27.11
This is the first release that contains the fix.
npm install systeminformation@4.27.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, it is crucial to thoroughly check or sanitize the service parameter strings that are passed to si.inetChecksite(). By properly validating and sanitizing user input, the risk of command injection can be reduced. However, applying the official patch by upgrading to the fixed version is the recommended solution.
Conclusion
The command injection vulnerability in systeminformation can have severe consequences, including unauthorized access and potential compromise of the entire system. It is crucial to upgrade to the fixed version (4.27.11 or later) or apply proper input validation and sanitization to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for systeminformation →
FAQ
systeminformation is an npm package for gathering system information in Node.js applications. It provides functions to retrieve data about the operating system, CPU, memory, network, and more.
A command injection vulnerability allows an attacker to execute arbitrary commands on a target system by injecting malicious code through user-controlled input.
The command injection vulnerability in systeminformation can lead to unauthorized access, data leakage, and potential compromise of the entire system.
To fix this vulnerability, upgrade to version 4.27.11 or later of the systeminformation package. Ensure that the service parameter strings passed to si.inetChecksite() are properly validated and sanitized.
If upgrading is not immediately possible, thoroughly check and sanitize the service parameter strings to reduce the risk of command injection. However, upgrading to the fixed version is highly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for systeminformation.
