systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

影響: npm:systeminformation < 5.33.16 → 5.33.16

On Windows, systeminformation@5.33.15 builds a PowerShell command using the value passed to services(). The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter string and run a PowerShell expression. The expression runs with the permissions of the Node.js process. This report confirms version 5.33.15. Other package versions have not been checked. Details In lib/proces…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 07:42, GitHub Advisory Database에서 "systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js, Windows. CVE: CVE-2026-116576.