CVE-2025-68154: systeminformation Command Injection Vulnerability in fsSize() Function on Windows
Summary
CVE-2025-68154: systeminformation has a Command Injection vulnerability in fsSize() function on Windows. Affects systeminformation versions < 5.27.14. Fixed in 5.27.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'systeminformation' package is a widely used Node.js library that provides detailed information about system hardware and operating system. It offers functionalities such as retrieving CPU, memory, disk, and network information. However, a critical vulnerability has been identified in the 'fsSize()' function, which can lead to OS Command Injection on Windows systems, allowing attackers to execute arbitrary commands.
Vulnerability Detail
The vulnerability arises from the 'fsSize()' function in the 'systeminformation' package, where the 'drive' parameter is directly concatenated into a PowerShell command without proper sanitization. This oversight allows an attacker to inject malicious commands through user-controlled input, potentially leading to remote code execution, data exfiltration, and other severe security risks. The vulnerability is classified as OS Command Injection (CWE-78) and has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 5.33.16 as of 22 Oct 2026
npm install systeminformation@5.33.16Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.27.14
This is the first release that contains the fix.
npm install systeminformation@5.27.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, you can implement a workaround by sanitizing the 'drive' parameter before passing it to the 'fsSize()' function. Here is an example of how to do this in your code:
const si = require('systeminformation');
const util = require('./util'); // Ensure you have the sanitizeShellString function available
const drive = util.sanitizeShellString(userInputDrive);
const diskInfo = await si.fsSize(drive);
Conclusion
The 'systeminformation' package has a critical command injection vulnerability that can be exploited on Windows systems. It is crucial to update to the patched version to mitigate risks. Users should also consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for systeminformation →
FAQ
The vulnerability is an OS Command Injection flaw that allows attackers to execute arbitrary commands on Windows systems through the 'fsSize()' function.
Applications using the 'systeminformation' package on Windows that pass user-controlled input to the 'fsSize()' function are affected.
Exploitation can lead to remote code execution, data exfiltration, privilege escalation, and other severe security incidents.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without signup.
Implement a workaround by sanitizing user input before passing it to the 'fsSize()' function, as shown in the provided code example.
References
Related vulnerabilities
Recent vulnerabilities recorded for systeminformation.
