OS Command Injection in systeminformation

2022-02-0923:14:11

CWE-78

GitHub Advisory Database

github.com

0.008 Low

EPSS

Percentile

81.1%

JSON

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.

CPENameOperatorVersion
systeminformationlt4.30.2

CPE	Name	Operator	Version
	systeminformation	lt	4.30.2

References

gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80

github.com/advisories/GHSA-8j36-q8x7-pm6q

github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js

github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc

github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc

nvd.nist.gov/vuln/detail/CVE-2020-7778

snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753