CVE-2025-68154High· 8.1▾ Twilightsysteminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 2.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
13%
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the fsSize() function in systeminformation is vulnerable to OS command injection on Windows systems. The optional drive parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to fsSize(), it is not vulnerable. Version 5.27.14 contains a patch.
systeminformation < 5.27.14Upgrade past the affected range:
systeminformation 5.27.14Connected by shared product, vendor, weakness, or advisory.
CVE-2026-26318High· 8.8Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
CVE-2026-50289Highsysteminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
CVE-2025-14586Medium· 6.3A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224
CVE-2025-15472High· 7.2A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0
CVE-2025-9580Medium· 6.3A security vulnerability has been detected in LB-LINK BL-X26 1.2.8
CVE-2025-9579Medium· 6.3A weakness has been identified in LB-LINK BL-X26 1.2.8