CVE-2020-26245CWE-471CWE-78

Prototype Pollution leading to Command Injection in systeminformation

High · published November 27, 2020

CVSS v3.1
8.1
EPSS
2%
Percentile
82.6
In the wild
Unconfirmed
What it is

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02229 · 82.6th percentile
Weaknesses
CWE-471 · Modification of Assumed-Immutable Data (MAID); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2020-11-27T19:50Z
EPSS history
Timeline
  • 27 NOV 19:50Z
    Prototype Pollution leading to Command Injection in systeminformation
    cvelistv5