CVE-2025-68154High· 8.1▾ Twilightsysteminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 2.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
13%
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the fsSize() function in systeminformation is vulnerable to OS command injection on Windows systems. The optional drive parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to fsSize(), it is not vulnerable. Version 5.27.14 contains a patch.
systeminformation < 5.27.14Upgrade past the affected range:
systeminformation 5.27.14Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116576High· 7.8systeminformation: Windows command injection in services() through Unicode quotation marks
CVE-2026-26318High· 8.8Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
CVE-2026-116673Low· 3.3systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
CVE-2026-116674Medium· 6.5systeminformation: Prototype pollution in `networkStats()` via the interface name
CVE-2022-33186Critical· 9.8A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling …
CVE-2022-37902High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface