CVE-2020-7752 Command Injection

What is CVE-2020-7752?

CVE-2020-7752 is a high-severity command injection vulnerability in systeminformation, published on 26 Oct 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.

Weakness: CWE-78

Which versions are affected by CVE-2020-7752?

2 open source packages ship an affected version, including systeminformation. It affects 1 product.

Products include Systeminformation Systeminformation.

How do I fix CVE-2020-7752?

Upgrade systeminformation to 4.27.11 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-7752 being exploited?

There is no known exploitation of CVE-2020-7752 in the wild and no public exploit code.

Other vulnerabilities in systeminformation

• CVE-2023-42810 systeminformation SSID Command Injection Vulnerability Critical 9.8
• CVE-2021-21388 Command Injection Vulnerability in systeminformation High 8.9
• CVE-2026-26318 systeminformation has Command Injection via Unsanitized `locate` Output in `versions()` High 8.8
• CVE-2026-50289 systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux High 8.7
• CVE-2026-26280 Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path High 8.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-94xh-2fmc-xf5j, SNYK-JS-SYSTEMINFORMATION-1021909.