System Information Library for Node.JS Command Injection. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 18/01/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| cordova | = 10.0.0 | |
| systeminformation | < 5.3.1 | 5.3.1 |
| systeminformation | < 5.3.1 | 5.3.1 |
command injection vulnerability
Problem was fixed with a parameter check. Please upgrade to version >= 5.3.1
If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free