CVE-2026-116576: systeminformation: Windows command injection in services() through Unicode quotation marks
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
systeminformationto a version that resolves this vulnerability.Fixed in 5.33.16
Event History
Frequently Asked Questions
Which deployments are realistically exposed to remote exploitation?
The package does not expose a network service itself. Remote exploitation depends on a consuming application passing attacker-controlled input into services() or getDynamicData(), and the vulnerable command construction occurs on Windows.
What access or input does an attacker need?
An attacker needs control over a service-name value that reaches services() or getDynamicData(). They can use Unicode quotation marks accepted by PowerShell as delimiters to escape the intended filter and inject a PowerShell expression.
What permissions would injected commands have?
The injected PowerShell expression runs with the permissions of the Node.js process account. Its impact is limited by that account's access, but may include reading or modifying accessible files and application data or disrupting the service.
What should be done to remediate the issue?
Upgrade systeminformation to version 5.33.16, which fixes the issue. If upgrading cannot happen immediately, ensure untrusted input cannot reach services() or getDynamicData().