systeminformation
5.33.18 · 28 Oct 2026MIT21.4M / weekRepositoryHomepagenpmAtom feed
Your version
5.23.12
13 Dec 20245.33.18 is the newest release of 5.x.
Security
8 advisories affect 5.23.12; 5.33.16 fixes them
- Highsysteminformation vulnerable to Windows command injection in services() through Unicode quotation marksGHSA-3f7j-7jwc-fxfj · 28 Oct 2026Fixed in 5.33.16
- Highsysteminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on LinuxGHSA-5xpp-75jx-m839 · 15 Jul 2026Fixed in 5.31.7
- HighSysteminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile nameGHSA-hvx9-hwr7-wjj9 · 13 May 2026Fixed in 5.31.6
- HighCommand Injection via Unsanitized `locate` Output in `versions()` — systeminformationGHSA-5vv4-hvf7-2h46 · 18 Feb 2026Fixed in 5.31.0
- HighSysteminformation has a Command Injection via unsanitized interface parameter in wifi.js retry pathGHSA-9c88-49p5-5ggf · 18 Feb 2026Fixed in 5.30.8
3 more
- Highsysteminformation has a Command Injection vulnerability in fsSize() function on WindowsGHSA-wphj-fx3q-84ch · 16 Dec 2025Fixed in 5.27.14
- Moderatesysteminformation has prototype pollution in `networkStats()` via the interface nameGHSA-7648-jmwf-vw7j · 28 Oct 2026Fixed in 5.33.13
- Lowsysteminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netGHSA-4vjg-vx72-qq4g · 28 Oct 2026Fixed in 5.33.14
Release note
No note was found for 5.23.12 on GitHub or in the repository's changelog.