High · published December 17, 2025
⚡ A simple drive parameter can lead to full command injection on Windows! The vulnerable `fsSize()` function in systeminformation lets attackers run arbitrary commands — yikes! 🔥 Think of it like a restaurant chef who cooks whatever a customer orders without checking if the ingredients are safe — one bad order can lead to a disastrous meal. Here, the `drive` parameter is that unchecked order, allowing anyone crafty enough to wreak havoc. If an attacker exploits this vulnerability, they could execute any command they want on your system, potentially leading to data breaches or complete system compromise. It’s like leaving your front door wide open for uninvited guests to mess with your belongings — absolutely devastating!
Think of it like a restaurant chef who cooks whatever a customer orders without checking if the ingredients are safe — one bad order can lead to a disastrous meal. Here, the `drive` parameter is that unchecked order, allowing anyone crafty enough to wreak havoc. The `fsSize()` function in systeminformation is vulnerable to OS command injection because it directly concatenates user input into a PowerShell command without any sanitization, allowing malicious input to be executed as an arbitrary command.
If an attacker exploits this vulnerability, they could execute any command they want on your system, potentially leading to data breaches or complete system compromise. It’s like leaving your front door wide open for uninvited guests to mess with your belongings — absolutely devastating! To secure your systems, immediately update systeminformation to version 5.27.14 or later. If you're building applications that use this function, audit your code to ensure no user-controlled input is passed to `fsSize()`. It’s essential to sanitize any input before using it in commands! You've got this! Follow these steps and you'll have your systems locked down and safe in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| systeminformation/systeminformation | < 5.27.14 | 5.27.14 |