{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/systeminformation--5.33.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:systeminformation_project:systeminformation:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-116576"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["systeminformation (\u003c 5.33.16)"],"_cs_severities":["high"],"_cs_tags":["command-injection","nodejs","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe systeminformation package version 5.33.15 and below contains a command injection vulnerability on Windows within the \u003ccode\u003eservices()\u003c/code\u003e function. The internal \u003ccode\u003esanitizeShellString()\u003c/code\u003e utility fails to strip Unicode left and right curly quotation marks (U+201C and U+201D). Because these characters are interpreted as string delimiters by PowerShell, an attacker can supply a specially crafted service name to terminate the intended \u003ccode\u003eGet-CimInstance\u003c/code\u003e filter string and inject arbitrary PowerShell commands. These commands execute with the privileges of the hosting Node.js process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows arbitrary command execution on the host operating system. The scope of impact is limited to the privileges of the Node.js process, which may include access to files, sensitive environment variables, or other application resources. Remote exploitability is dependent on whether a consuming application passes attacker-controlled input directly to the \u003ccode\u003eservices()\u003c/code\u003e function.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003esysteminformation\u003c/code\u003e package to version 5.33.16 or later.\u003c/li\u003e\n\u003cli\u003eReview applications using \u003ccode\u003esysteminformation\u003c/code\u003e to identify if any user-supplied data is passed as arguments to the \u003ccode\u003eservices()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eApply input validation/sanitization to any data before passing it to library functions, treating \u003ccode\u003eservices()\u003c/code\u003e inputs as untrusted content.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T00:11:46Z","date_published":"2026-10-29T00:11:46Z","id":"https://feed.craftedsignal.io/briefs/2026-10-systeminformation-command-injection/","summary":"The systeminformation Node.js package contains a command injection vulnerability in its services() function on Windows caused by insufficient sanitization of Unicode curly quotation marks.","title":"systeminformation: Windows command injection via services() (CVE-2026-116576)","url":"https://feed.craftedsignal.io/briefs/2026-10-systeminformation-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Systeminformation (\u003c 5.33.16)","version":"https://jsonfeed.org/version/1.1"}