CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-26300
Critical (9.8) in systeminformation systeminformation. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in systeminformation 4.26.2.
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-78, CWE-77
- Published
- Modified
- Record from
- the NVD, synced
Affected
- systeminformation:systeminformation
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fj59-f6c3-3vw4 | npm | systeminformation | <4.26.2 | 4.26.2 |
References
- https://github.com/advisories/GHSA-fj59-f6c3-3vw4
- https://github.com/sebhildebrandt/systeminformation/commit/bad372e654cdd549e7d786acbba0035ded54c607
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-fj59-f6c3-3vw4
- https://www.npmjs.com/package/systeminformation
- https://github.com/advisories/GHSA-fj59-f6c3-3vw4