GHSA-4v2w-h9jm-mqjg
Prototype Pollution in systeminformation
At a glance
- Published
- Updated
- CVE
- CVE-2020-26245
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Description
### Impact command injection vulnerability by prototype pollution ### Patches Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version >= 4.30.2 ### Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite() ### For more information If you have any questions or comments about this advisory: * Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)
Affected packages
| Package | Versions |
|---|---|
| npm · systeminformation | introduced 0, fixed 4.30.5 |
References
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4v2w-h9jm-mqjg WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-26245 ADVISORY
- https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |