systeminformation
5.33.18 · 28 Oct 2026MIT21.4M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 5.33.18 | Safe from 5.33.16 | |
| 4.34.23 | 56 open advisories, worst high · last release May 2021, no longer updated |
- Criticalsysteminformation SSID Command Injection VulnerabilityGHSA-gx6r-qc2v-3p3v · 21 Sep 2023fixed in 5.21.7
- Highsysteminformation vulnerable to Windows command injection in services() through Unicode quotation marksGHSA-3f7j-7jwc-fxfj · 28 Oct 2026fixed in 5.33.16
- Highsysteminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on LinuxGHSA-5xpp-75jx-m839 · 15 Jul 2026fixed in 5.31.7
- HighSysteminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile nameGHSA-hvx9-hwr7-wjj9 · 13 May 2026fixed in 5.31.6
- HighCommand Injection via Unsanitized `locate` Output in `versions()` — systeminformationGHSA-5vv4-hvf7-2h46 · 18 Feb 2026fixed in 5.31.0
- HighSysteminformation has a Command Injection via unsanitized interface parameter in wifi.js retry pathGHSA-9c88-49p5-5ggf · 18 Feb 2026fixed in 5.30.8
- Highsysteminformation has a Command Injection vulnerability in fsSize() function on WindowsGHSA-wphj-fx3q-84ch · 16 Dec 2025fixed in 5.27.14
- HighSysteminformation has command injection vulnerability in getWindowsIEEE8021x (SSID)GHSA-cvv5-9h9w-qp2m · 20 Dec 2024fixed in 5.23.8
- HighOS Command Injection in systeminformationGHSA-8j36-q8x7-pm6q · 9 Feb 2022fixed in 4.30.2
- HighCommand Injection Vulnerability in systeminformationGHSA-jff2-qjw8-5476 · 6 Apr 2021fixed in 5.6.4
- HighCommand Injection VulnerabilityGHSA-2m8v-572m-ff2v · 16 Feb 2021fixed in 5.3.1
- Highsysteminformation command injection vulnerabilityGHSA-94xh-2fmc-xf5j · 27 Oct 2020fixed in 4.27.11
- Moderatesysteminformation has prototype pollution in `networkStats()` via the interface nameGHSA-7648-jmwf-vw7j · 28 Oct 2026fixed in 5.33.13
- ModerateCommand Injection Vulnerability in systeminformationGHSA-m57p-p67h-mq74 · 16 Dec 2020fixed in 4.31.1
- ModeratePrototype Pollution in systeminformationGHSA-4v2w-h9jm-mqjg · 27 Nov 2020fixed in 4.30.5
- ModerateCommand Injection in systeminformationGHSA-fj59-f6c3-3vw4 · 27 Oct 2020fixed in 4.26.2
- Lowsysteminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netGHSA-4vjg-vx72-qq4g · 28 Oct 2026fixed in 5.33.14
Registry facts last checked 29 Oct 2026. Releases and advisories last read 29 Oct 2026.