CVE-2020-26300: Command injection in systeminformation
Impact command injection vulnerability
Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2
Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to is.services(), is.inetChecksite(), si.inetLatency(), si.networkStats(), is.services() and si.processLoad()
References Are there any links users can visit to find out more?
For more information If you have any questions or comments about this advisory: Open an issue in systeminformation
Other sources
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-26300?
CVE-2020-26300 is a command injection vulnerability in the systeminformation npm package for node.js.
How severe is CVE-2020-26300?
CVE-2020-26300 has a severity rating of 9.8, which is considered critical.
What is the impact of CVE-2020-26300?
The impact of CVE-2020-26300 is a command injection vulnerability, which could allow an attacker to execute arbitrary commands on the affected system.
How can I fix CVE-2020-26300?
To fix CVE-2020-26300, you need to upgrade to version 4.26.2 or higher of the systeminformation npm package.
Are there any workarounds for CVE-2020-26300?
If you cannot upgrade to a secure version, you should ensure that service parameter strings passed to certain functions are properly checked or sanitized to prevent command injection.