Packages / systeminformation / Security

HighVulnerabilityGHSA-8j36-q8x7-pm6qCVE-2020-7778SNYK-JS-SYSTEMINFORMATION-1043753Published 9 Feb 2022

OS Command Injection in systeminformation

Your version

Affected releases · systeminformation

  • 4.x4.0.0 – 4.30.1Fixed in 4.30.2
  • 3.x and older1.0.0 – 3.54.0No fix, no longer updated

On 4.x, the newest line:

npm install systeminformation@4.30.2
Every release on a timeline
5.x

  1. Not affected

    5.0.0 – 5.33.18

    375 releases, latest

4.x

  1. Affected

    4.0.0 – 4.30.1

    162 releases

  2. Fixed

    4.30.2 – 4.34.23

    47 releases

3.x

  1. Affected

    3.0.0 – 3.54.0

    177 releases

2.x

  1. Affected

    2.0.0 – 2.0.5

    6 releases

1.x

  1. Affected

    1.0.0 – 1.0.7

    8 releases

775 stable releases of systeminformation, oldest to newest, one row per major.

What happens

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.