Prototype Pollution in systeminformation

NGHIÊM TRỌNG 9.8CVE-2020-26245 · GHSA-4v2w-h9jm-mqjg · Công bố 27/11/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-26245 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng systeminformation (systeminformation), systeminformation.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.2%, cao hơn 82.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.30.5 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
systeminformation systeminformation	`< 4.30.5`	`4.30.5`
systeminformation npm	`< 4.30.5`	`4.30.5`

Mô tả

Impact

command injection vulnerability by prototype pollution

Patches

Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version >= 4.30.2

Workarounds

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()

For more information

If you have any questions or comments about this advisory:

Open an issue in systeminformation

Mô tả của NVD

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().