UBUNTU-CVE-2026-116576: High severity ubuntu/node-systeminformation vulnerability

Published Oct 26, 2026

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.

Affected Software

1 affected component

ubuntu/node-systeminformation*

Event History

Oct 26, 2026

CVE Published

via OSV·09:18 PM

Data Sourced

via OSV·09:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to remote exploitation?

The package does not provide a network service itself. Remote exploitation depends on an application passing attacker-controlled input to services() or getDynamicData(), and the vulnerable command execution occurs on Windows.

What level of access does an attacker need to exploit this issue?

An attacker needs a way to supply a crafted service name to the affected library call through the consuming application. Successful exploitation executes a PowerShell expression with the permissions of the Node.js process account.

Are default installations necessarily vulnerable?

No. Exposure requires both a version earlier than 5.33.16 and application behavior that forwards untrusted input into services() or getDynamicData() on Windows.

What can be done if updating is not immediately possible?

Do not pass untrusted service-name input to services() or getDynamicData(). Restrict accepted values to a controlled allowlist before invoking the library to prevent crafted PowerShell filter content.

How can I determine whether an application is affected?

Check whether it uses systeminformation earlier than 5.33.16 and runs on Windows. Review calls to services() and getDynamicData() to determine whether their service-name input can be influenced by untrusted users or external data.

UBUNTU-CVE-2026-116576: High severity ubuntu/node-systeminformation vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are realistically exposed to remote exploitation?

What level of access does an attacker need to exploit this issue?

Are default installations necessarily vulnerable?

What can be done if updating is not immediately possible?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to remote exploitation?

What level of access does an attacker need to exploit this issue?

Are default installations necessarily vulnerable?

What can be done if updating is not immediately possible?

How can I determine whether an application is affected?