{"id":"ghsa-ghsa-3f7j-7jwc-fxfj","seq":2056908,"kind":"advisory","title":"systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks","url":"https://github.com/advisories/GHSA-3f7j-7jwc-fxfj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-3f7j-7jwc-fxfj","summary":"影響: npm:systeminformation < 5.33.16 → 5.33.16\nOn Windows, systeminformation@5.33.15 builds a PowerShell command using the value passed to services(). The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter string and run a PowerShell expression. The expression runs with the permissions of the Node.js process. This report confirms version 5.33.15. Other package versions have not been checked. Details In lib/proces…","severity":"high","techs":["nodejs","windows"],"cves":["CVE-2026-116576"],"tags":["GHSA-3f7j-7jwc-fxfj","systeminformation"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T22:42:49.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}