Live › vulnerability › CVE-2026-116576
Go to dashboardThe systeminformation npm library builds a PowerShell Get-CimInstance filter from a service name and its sanitizer strips only ASCII quotes, so Unicode quotation marks let crafted input break out of the filter. An attacker who controls the service name passed to services() or getDynamicData() can run PowerShell with the permissions of the Node.js process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Only Node.js applications on Windows that call services() or getDynamicData() with input an attacker can influence, such as a service name from a request or form. Applications that only call systeminformation with fixed local values, or that run on Linux or macOS, are not exposed through this path. The library opens no network port itself.
No product ranges from the sources yet.
npm ls systeminformation in each project to find the installed version.si.services() or si.getDynamicData() on Windows.5.33.16 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.
This page as .md · .json · in your agent: get_signal("CVE-2026-116576")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.