GHSA-8j36-q8x7-pm6q

OS Command Injection in systeminformation

En bref

Publiée: 2022-02-09 23:14 UTC
Mise à jour: 2026-09-10 03:49 UTC
CVE: CVE-2020-7778
Alias: SNYK-JS-SYSTEMINFORMATION-1043753
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.

Paquets affectés

Paquet	Versions
npm · systeminformation	introduced 0, fixed 4.30.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2020-7778 ADVISORY
https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc WEB
https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc WEB
https://gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80 WEB
https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js WEB
https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database