CVE-2026-116576
Deferred Deferred - Pending Action

Command Injection in systeminformation Library

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-27
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116576
EUVD
EUVD-2026-110317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sebhildebrandt systeminformation < 5.33.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the systeminformation library for Node.js. It allows an attacker to inject malicious PowerShell commands by exploiting improper input sanitization. The sanitizer removes ASCII quotes but permits Unicode quotation marks, which PowerShell interprets as string delimiters. This lets crafted input break out of the intended filter and execute arbitrary code with the Node.js process account's permissions.

Detection Guidance

This vulnerability affects applications using systeminformation library versions before 5.33.16. Check installed versions with 'npm list systeminformation' or inspect package.json files for versions below 5.33.16. Monitor Node.js processes for unusual PowerShell command execution patterns.

Impact Analysis

If you use a vulnerable version of systeminformation, an attacker could execute arbitrary code on your system with the permissions of the Node.js process. This may allow them to read or modify files, alter application data, or disrupt services. The impact depends on the Node.js process account's privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate GDPR or HIPAA requirements for data protection and integrity. Organizations using affected versions may face compliance violations if data breaches occur due to this issue.

Mitigation Strategies

Upgrade systeminformation to version 5.33.16 or later immediately. Review consuming applications to ensure they do not forward untrusted input to services() or getDynamicData(). Apply least-privilege principles to Node.js processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart