CVE-2026-116576 in systeminformation
Summary
by MITRE • 10/26/2026
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in systeminformation versions prior to 5.33.16 represents a critical command injection flaw rooted in insufficient sanitization of user-supplied input within the services() function located in lib/processes.js. This library, commonly used for retrieving operating system and hardware information on Node.js platforms, constructs PowerShell commands by embedding service names into Get-CimInstance filters. The security failure occurs because the sanitization logic implemented via sanitizeShellString() in lib/util.js is incomplete. Specifically, while the sanitizer effectively removes standard ASCII quotation marks which are common delimiters in many contexts, it fails to account for Unicode equivalents of these characters. PowerShell interprets certain Unicode quotation marks as valid string delimiters just like their ASCII counterparts. This oversight allows an attacker who can control the service name input to bypass the intended filtering mechanism by using a Unicode quote character instead of a standard double or single quote.
By injecting a crafted service name containing a Unicode quotation mark, an adversary can terminate the original PowerShell filter expression prematurely and inject arbitrary commands into the execution pipeline. Since these commands are executed via util.powerShell(), they run with the same privileges as the Node.js process that invoked them. This privilege level is significant because it grants the attacker access to read sensitive files, modify application data, alter system configurations, or disrupt services depending on what permissions the underlying Node.js process holds. The impact is not merely theoretical; if a consuming application forwards untrusted input directly to the services() function or getDynamicData(), an attacker can achieve remote code execution capabilities without needing direct network access to the library itself, relying instead on the application's logic to pass malicious data into this vulnerable component.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-20 Improper Input Validation. The root cause is a failure to validate input against all possible delimiters that the target interpreter, PowerShell, recognizes as significant for command structure. This technique leverages Unicode confusion, where different character encodings are treated equivalently by the parser but not adequately handled by the security controls in place. In terms of adversary behavior, this maps to ATT&CK T1059 Command and Scripting Interpreter with sub-technique PowerShell, as well as T1620 Reflective Code Loading if the injected commands involve loading modules or executing scripts from memory, although the primary vector here is direct command injection through a legitimate utility.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The most effective remediation is to upgrade systeminformation to version 5.33.16 or later, where this sanitization logic has been corrected to handle Unicode delimiters appropriately. For applications that cannot immediately update the dependency, input validation should be implemented at the application layer before passing data to any library functions that interact with shell interpreters. This includes enforcing strict allowlists for expected service names rather than relying solely on blacklist-based sanitization which is prone to bypasses via encoding tricks or new character types. Additionally, developers should avoid using high-privilege accounts to run Node.js applications whenever possible, adhering to the principle of least privilege to limit the blast radius if such an injection were to occur in other contexts. Regular security audits and static analysis tools configured to detect shell command construction patterns can also help identify similar vulnerabilities across a codebase before they are exploited.