systeminformation SSID Command Injection Vulnerability

緊急 9.8CVE-2023-42810 · GHSA-gx6r-qc2v-3p3v · 21/09/2023 公開 · 17/06/2026 更新

要点

CVE-2023-42810 は systeminformation (systeminformation), systeminformation に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.2%（全脆弱性の 82.6% より高い）。
対処：5.21.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
systeminformation systeminformation	`≥ 5.0.0, < 5.21.7`	`5.21.7`
systeminformation npm	`≥ 5.0.0, < 5.21.7`	`5.21.7`

概要

Impact

SSID Command Injection Vulnerability

Patches

Problem was fixed with a parameter check. Please upgrade to version >= 5.21.7, Version 4 was not affected

Workarounds

If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to wifiConnections(), wifiNetworks() (string only)

References

NVD の説明

systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).