{"id":"GHSA-3f7j-7jwc-fxfj","summary":"systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks","details":"### Summary\n\nOn Windows, `systeminformation@5.33.15` builds a PowerShell command using the value passed to `services()`. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter string and run a PowerShell expression. The expression runs with the permissions of the Node.js process.\n\nThis report confirms version `5.33.15`. Other package versions have not been checked.\n\n### Details\n\nIn `lib/processes.js`, `services()` sanitizes the caller's string with `sanitizeShellString()` and later inserts each resulting name into a `Get-CimInstance Win32_Service -Filter` command. The Windows branch passes that command to `util.powerShell()`.\n\nThe sanitizer in `lib/util.js` removes the ASCII double quote, but it does not remove U+201C or U+201D, the left and right curly double quotation marks. It also permits spaces and parentheses when called in its default, non-strict mode. PowerShell accepts the curly marks as string delimiters, so an input can end the filter string and place a command expression in the generated command.\n\nFor example, the input below uses curly quotation marks to end the generated filter string and execute `New-Item`. I reproduced this call on Windows against the checked-out `systeminformation@5.33.15` source; it created a marker file with the Node.js process account.\n\n### Proof of concept\n\nRun this on Windows in a disposable directory with Node.js and PowerShell available:\n\n```powershell\nmkdir si-command-injection-repro\ncd si-command-injection-repro\nnpm init -y\nnpm install systeminformation@5.33.15\n```\n\nSave the following as `poc.cjs`, then run `node poc.cjs`:\n\n```js\n'use strict';\n\nconst fs = require('node:fs');\nconst path = require('node:path');\nconst si = require('systeminformation');\n\n(async () =\u003e {\n  const markerName = `si-injection-${process.pid}.txt`;\n  const markerPath = path.join(process.cwd(), markerName);\n  fs.rmSync(markerPath, { force: true });\n\n  try {\n    await si.services(`not-a-service” (New-Item -Name ${markerName} -ItemType File -Force) “`);\n    console.log(`markerCreated=${fs.existsSync(markerPath)}`);\n  } finally {\n    fs.rmSync(markerPath, { force: true });\n  }\n})().catch((error) =\u003e {\n  console.error(error);\n  process.exitCode = 1;\n});\n```\n\nExpected output:\n\n```text\nmarkerCreated=true\n```\n\nThe Windows run returned an array and created the marker (`markerCreated: true`). A benign input left the marker absent. The script removes the marker afterward. I did not identify an application network route that forwards remote input to `services()`, so remote exploitability depends on the consuming application.\n\n### Impact\n\nAn application that passes attacker-controlled input to `services()` on Windows can execute PowerShell commands with the Node.js process account's permissions. Depending on that account, commands may read or change accessible files, alter application data, or disrupt the service. I searched this repository for HTTP servers, route handlers, and listener calls and found none. `services()` is exposed through the package API and `getDynamicData()`, so a consuming application could make the input network-reachable if it forwards request data. A separate loopback HTTP harness did trigger the command through a query parameter, but that server was test code and is not part of this repository. The project's `docs/security.html` already warns that arbitrary untrusted input to `services()` needs caution because package sanitization does not cover every case.","aliases":["CVE-2026-116576"],"modified":"2026-10-28T23:00:04.050952274Z","published":"2026-10-28T22:42:49Z","database_specific":{"nvd_published_at":"2026-10-26T21:18:13Z","cwe_ids":["CWE-78"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-10-28T22:42:49Z"},"references":[{"type":"WEB","url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-3f7j-7jwc-fxfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116576"},{"type":"WEB","url":"https://github.com/sebhildebrandt/systeminformation/commit/5014c6d25cfce7363b937977327baa853cdba0bf"},{"type":"PACKAGE","url":"https://github.com/sebhildebrandt/systeminformation"},{"type":"WEB","url":"https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.16"}],"affected":[{"package":{"name":"systeminformation","ecosystem":"npm","purl":"pkg:npm/systeminformation"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.33.16"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3f7j-7jwc-fxfj/GHSA-3f7j-7jwc-fxfj.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}