CVE-2020-26274 Command Injection Vulnerability in systeminformation
Attackers can execute arbitrary commands via unsanitized input in the systeminformation npm package, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26274?
CVE-2020-26274 is a medium-severity command injection vulnerability in sebhildebrandt systeminformation, published on 16 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.
Weakness: CWE-78
Which versions are affected by CVE-2020-26274?
2 open source packages ship an affected version, including systeminformation. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
systeminformation npm | All versions | 4.31.1 |
systeminformation npm | All versions | 4.31.1 |
Products include Systeminformation Systeminformation.
How do I fix CVE-2020-26274?
Upgrade systeminformation to 4.31.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-26274 being exploited?
There is no known exploitation of CVE-2020-26274 in the wild and no public exploit code.
Other vulnerabilities in sebhildebrandt systeminformation
- CVE-2023-42810 systeminformation SSID Command Injection Vulnerability
- CVE-2021-21388 Command Injection Vulnerability in systeminformation
- CVE-2026-26318 systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`
- CVE-2020-7752 Command Injection
- CVE-2026-50289 systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
Sources
Also known as GHSA-m57p-p67h-mq74.