Prototype Pollution leading to Command Injection in systeminformation (sebhildebrandt systeminformation)
At a glance
- Source
- NVD
- EPSS
- EPSS 2.23 % · percentile 83 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
- CWE-471 — Modification of Assumed-Immutable Data (MAID)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L | GitHub_M |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-4v2w-h9jm-mqjg — Prototype Pollution in systeminformation
European references
- ENISA EUVD · EUVD-2020-1444
- GCVE · GCVE-0-2020-26245
Affected configurations (NVD CPE)
cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*< 4.30.5
Affected products
| Product | Versions |
|---|---|
| sebhildebrandt · systeminformation | affected < 4.30.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |