systeminformation: Windows command injection via services() (CVE-2026-116576)

The systeminformation package version 5.33.15 and below contains a command injection vulnerability on Windows within the services() function. The internal sanitizeShellString() utility fails to strip Unicode left and right curly quotation marks (U+201C and U+201D). Because these characters are interpreted as string delimiters by PowerShell, an attacker can supply a specially crafted service name to terminate the intended Get-CimInstance filter string and inject arbitrary PowerShell commands. These commands execute with the privileges of the hosting Node.js process.

Impact

Successful exploitation allows arbitrary command execution on the host operating system. The scope of impact is limited to the privileges of the Node.js process, which may include access to files, sensitive environment variables, or other application resources. Remote exploitability is dependent on whether a consuming application passes attacker-controlled input directly to the services() function.

Recommendation

• Upgrade the systeminformation package to version 5.33.16 or later.
• Review applications using systeminformation to identify if any user-supplied data is passed as arguments to the services() function.
• Apply input validation/sanitization to any data before passing it to library functions, treating services() inputs as untrusted content.