CVEssebhildebrandtCVE-2026-116576Published Oct 26, 20:18 · Updated Oct 26, 20:18 UTC
7.8
HighCVSS 3.1 · from GitHub_M
CVE-2026-116576

systeminformation: Windows command injection in services() through Unicode quotation marks

systeminformation · OS command injection · CWE-78
Affectedsysteminformation
FixNo fix listed yet.
PublishedOct 26, 20:18 · GitHub_M
ScoredOct 26 · 7.8 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC

What we know

No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.

Description

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed insysteminformation< 5.33.16–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-3f7j-7jwc-fxfj · github.comrefsource_CONFIRMgithub.com/sebhildebrandt/systeminformation/commit/5014c6d25cfce7363b937977327baa853cdba0bf · github.comrefsource_MISCgithub.com/sebhildebrandt/systeminformation/releases/tag/v5.33.16 · github.comrefsource_MISC

Other CVEs in systeminformation

All 14 →
6.5systeminformation: Prototype pollution in `networkStats()` via the interface name · CVE-2026-116674Oct 273.3systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net · CVE-2026-116673Oct 278.7systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux · CVE-2026-50289Jul 17