Packages / systeminformation / Security

CriticalVulnerabilityGHSA-gx6r-qc2v-3p3vCVE-2023-42810Published 21 Sep 2023

systeminformation SSID Command Injection Vulnerability

Your version

Affected releases · systeminformation

  • 5.x5.0.0 – 5.21.6Fixed in 5.21.7

On 5.x, the newest line:

npm install systeminformation@5.21.7
Every release on a timeline

  1. Not affected

    1.0.0 – 4.34.23

    400 releases

  2. Affected

    5.0.0 – 5.21.6

    216 releases

  3. Fixed

    5.21.7 – 5.33.18

    159 releases, latest

775 stable releases of systeminformation, oldest to newest.

What happens

Impact

SSID Command Injection Vulnerability

Patches

Problem was fixed with a parameter check. Please upgrade to version >= 5.21.7, Version 4 was not affected

Workarounds

If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to wifiConnections(), wifiNetworks() (string only)

References

See also systeminformation.io/security.html