Prototype Pollution in systeminformation

緊急 9.8CVE-2020-26245 · GHSA-4v2w-h9jm-mqjg · 27/11/2020 公開 · 17/06/2026 更新

要点

CVE-2020-26245 は systeminformation (systeminformation), systeminformation に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.2%（全脆弱性の 82.7% より高い）。
対処：4.30.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
systeminformation systeminformation	`< 4.30.5`	`4.30.5`
systeminformation npm	`< 4.30.5`	`4.30.5`

概要

Impact

command injection vulnerability by prototype pollution

Patches

Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version >= 4.30.2

Workarounds

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()

For more information

If you have any questions or comments about this advisory:

Open an issue in systeminformation

NVD の説明

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().