CVE-2021-21315-PoC

CVE-2021-21315-systeminformation This is Proof of Concept for CVE-2021-21315 which affects The System Information Library for Node.JS npm package "systeminformation". npmjs.com/systeminformation "be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite,...

ROOT-APP-NPM-CVE-2026-116576 CVE-2026-116576 in systeminformation - Patched by Root

Root has patched CVE-2026-116576 in the systeminformation package for Root:npm. Multiple fixed versions available...

CVE-2021-21315-exploit

CVE-2021-21315 Exploit Des: My python Script to exploit system Information Library for Node.JS npm package "systeminformation". npmjs.com/systeminformation I thought this POC will not show real world impact, But it'll be cool in CTF's...

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...

CLSA-2026-1793717506 TuxCare security update for systeminformation (1 CVE)

TuxCare rebuilt systeminformation to address 1 CVE. Fixed in 5.23.8-tuxcare.4...

CLSA-2026-1793698099 TuxCare security update for systeminformation (2 CVEs)

TuxCare rebuilt systeminformation to address 2 CVEs. Fixed in 5.23.8-tuxcare.3...

Linux Distros Unpatched Vulnerability : CVE-2026-50289

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces on Linux is vulnerable to OS command injection through...

CVE-2026-116673

A flaw was found in systeminformation. The library fails to properly validate user-supplied network interface names when querying network statistics on Linux systems. A local attacker who can control this parameter and create symbolic links on the local filesystem can exploit this path traversal...

CVE-2026-116674

A flaw was found in systeminformation. When processing network statistics on BSD-based systems, caller-controlled interface names are improperly handled during internal cache lookups. An attacker capable of supplying input to the network statistics function can trigger prototype pollution,...

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @abtnode/core (>=1.0.15, <=1.1.9) +1023 more potentially affected by CVE-2026-116576 via systeminformation (>=3.30.6, <=5.33.15)

systeminformation NPM version =3.30.6, =1.17.6-next.0, =1.0.15, =0.0.104, =3.0.0-alpha.0, =0.0.6, =0.0.63, =0.0.2, =3.0.0-alpha.0, =0.26.4, =0.1.1, =0.1.1, =4.1.0-rc.4, =5.2.0-revision.1, =4.0.0-devnet.2-patch.0, =0.0.1-2.1-beta-provision, =2.2.0 and more Source cves: CVE-2026-116576 Source...

npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

npm: systeminformation vulnerable to Windows command injection in services through Unicode quotation marks vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.16...

GHSA-3F7J-7JWC-FXFJ systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

EUVD-2026-110317

systeminformation vulnerable to Windows command injection in services through Unicode quotation marks...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @abtnode/core (>=1.0.15, <=1.1.9) +1023 more potentially affected by CVE-2026-116576 via systeminformation (>=3.30.6, <=5.33.15)

systeminformation NPM version =3.30.6, =1.17.6-next.0, =1.0.15, =0.0.104, =3.0.0-alpha.0, =0.0.6, =0.0.63, =0.0.2, =3.0.0-alpha.0, =0.26.4, =0.1.1, =0.1.1, =4.1.0-rc.4, =5.2.0-revision.1, =4.0.0-devnet.2-patch.0, =0.0.1-2.1-beta-provision, =2.2.0 and more Source cves: CVE-2026-116576 Source...

EUVD-2026-111101

systeminformation has path traversal in Linux networkStats that allows symlink-based file disclosure outside /sys/class/net...

Symlink Attack

Overview systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Symlink Attack via the networkStatsSingle function in lib/network.js when a network interface name containing path traversal sequences e.g. ../ is passed to networkStats o...

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

Summary On Linux, [email protected] builds /sys/class/net/ paths from the caller-supplied networkStatsiface value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function...

GHSA-4VJG-VX72-QQ4G systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

Summary On Linux, [email protected] builds /sys/class/net/ paths from the caller-supplied networkStatsiface value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function...

npm: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

npm: systeminformation has path traversal in Linux networkStats that allows symlink-based file disclosure outside /sys/class/net vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.14...