Description
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
Remediation
References
https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61
https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909
Related Vulnerabilities
CVE-2022-25923 Vulnerability in npm package exec-local-bin
CVE-2022-29256 Vulnerability in maven package org.webjars.npm:sharp
CVE-2020-7733 Vulnerability in maven package org.webjars.npm:ua-parser-js
CVE-2017-16124 Vulnerability in npm package node-server-forfront
CVE-2023-47324 Vulnerability in maven package org.silverpeas.core:silverpeas-core