CVE-2023-42810: systeminformation SSID Command Injection Vulnerability
Summary
CVE-2023-42810: systeminformation SSID Command Injection Vulnerability. Affects systeminformation versions >= 5.0.0, < 5.21.7. Fixed in 5.21.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The systeminformation package is an npm package that provides system information for Node.js applications. It offers various functions to retrieve information about the system, including network-related details. This vulnerability affects versions 5.0.0 to 5.21.6 of the systeminformation package.
Vulnerability Detail
The SSID Command Injection vulnerability in the systeminformation package allows an attacker to execute arbitrary commands on the system by injecting malicious input into the SSID parameter. This can lead to unauthorized access, data leakage, or complete compromise of the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 5.33.16 as of 22 Oct 2026
npm install systeminformation@5.33.16Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.21.7
This is the first release that contains the fix.
npm install systeminformation@5.21.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to sanitize or validate any user-supplied input that is passed to the wifiConnections() and wifiNetworks() functions. By ensuring that the input does not contain any malicious characters or commands, the risk of command injection can be reduced. Here's an example of how to sanitize the SSID parameter:
const systeminformation = require('systeminformation');
const ssid = sanitizeUserInput(userInput);
systeminformation.wifiConnections(ssid, (data) => {
// Process the data
});
Conclusion
The systeminformation package is vulnerable to an SSID Command Injection vulnerability. It is crucial to upgrade to version 5.21.7 or higher to mitigate the risk of exploitation. If immediate upgrading is not feasible, sanitizing user input can provide temporary protection. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for systeminformation →
FAQ
The vulnerability allows an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access, data leakage, or complete compromise of the affected system.
Versions 5.0.0 to 5.21.6 of the systeminformation package are affected by this vulnerability.
To fix this vulnerability, upgrade the systeminformation package to version 5.21.7 or higher.
If immediate upgrading is not possible, you can sanitize or validate user-supplied input passed to the wifiConnections() and wifiNetworks() functions to reduce the risk of command injection.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for systeminformation.
