systeminformation: Windows command injection in services() via Unicode quotes
Summary
systeminformation, a Node.js library for system and OS information, contains a command injection flaw in services() on Windows. The input sanitizer removes ASCII quotes but not Unicode quotation marks, which PowerShell accepts as string delimiters, so a crafted service name can inject PowerShell commands. An attacker can run code with the permissions of the Node.js process, read or change accessible files, alter application data or disrupt the service. Exploitation requires that an application forwards attacker-controlled input to services() or getDynamicData().
Affected
- systeminformation before 5.33.16 (vulnerable code path is Windows-only)
Fixed in
- Upgrade to systeminformation 5.33.16 or later.
- Newer releases exist; check npm for the current version before pinning.
Workaround
Unknown. The vendor documents no workaround. As an interim measure, allow only plausible Windows service names before the input reaches services() or getDynamicData(). This is not a vendor fix.
Exploitation
- Known exploited in the wild: not found.
- Public proof of concept: yes. The GHSA contains a reproduction snippet with a harmless marker action; it has not been independently reproduced here.
Our recommendation
- Identify all Node.js projects and lockfiles that include systeminformation, including transitive dependencies.
- Upgrade to 5.33.16 or later.
- On Windows hosts, check whether user-controlled values can reach services() or getDynamicData(). If they can, add strict input validation and prioritise the upgrade.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Commit 5014c6d: sanitizeShellString extended (Windows) github.com
- Release v5.33.16 github.com
- GitHub Security Advisory GHSA-3f7j-7jwc-fxfj github.com
- OSV entry GHSA-3f7j-7jwc-fxfj osv.dev
- GitLab advisory mirror CVE-2026-116576 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:15.
Original description (NVD)
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.