Description
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Remediation
References
https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
https://security.netapp.com/advisory/ntap-20210312-0007/
https://www.npmjs.com/package/systeminformation
Related Vulnerabilities
CVE-2022-25873 Vulnerability in maven package org.webjars.bowergithub.vuetifyjs:vuetify
CVE-2020-28452 Vulnerability in maven package com.softwaremill.akka-http-session:core_2.11
CVE-2018-1000665 Vulnerability in maven package org.dojotoolkit:dojo
CVE-2018-3721 Vulnerability in npm package lodash.mergewith
CVE-2023-46495 Vulnerability in npm package @evershop/evershop