{"id":"CVE-2026-116576","kind":"vulnerability","aliases":["CVE-2026-116576"],"related":[],"title":"systeminformation: Unicode quotes bypass sanitizer, enabling PowerShell injection on Windows","description":"systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.","summary":"The systeminformation npm library builds a PowerShell Get-CimInstance filter from a service name and its sanitizer strips only ASCII quotes, so Unicode quotation marks let crafted input break out of the filter. An attacker who controls the service name passed to services() or getDynamicData() can run PowerShell with the permissions of the Node.js process.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","package","systeminformation","windows"],"not_affected_if":["default-config","linux-or-macos-only","no-user-controlled-service-name"],"how_to_check":"- Run `npm ls systeminformation` in each project to find the installed version.\n- Check whether application code passes user-controlled input to `si.services()` or `si.getDynamicData()` on Windows.","fix":"- Upgrade the systeminformation package to `5.33.16` or later.","status":"open","published_at":"2026-10-26T21:18:13+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:08+00:00","updated_at":"2026-10-26T21:21:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T21:21:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the systeminformation package to `5.33.16` or later.","reach":"unknown","title":"systeminformation: Unicode quotes bypass sanitizer, enabling PowerShell injection on Windows","impact":"high","summary":"The systeminformation npm library builds a PowerShell Get-CimInstance filter from a service name and its sanitizer strips only ASCII quotes, so Unicode quotation marks let crafted input break out of the filter. An attacker who controls the service name passed to services() or getDynamicData() can run PowerShell with the permissions of the Node.js process.","category":"package","nicknames":[],"who_cares":["node.js","windows","systeminformation"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs PowerShell as the Node.js process account, reading or changing files","analyst_note":"","how_to_check":"- Run `npm ls systeminformation` in each project to find the installed version.\n- Check whether application code passes user-controlled input to `si.services()` or `si.getDynamicData()` on Windows.","needs_analyst":false,"not_affected_if":["linux-or-macos-only","no-user-controlled-service-name","default-config"],"who_is_affected":"Only Node.js applications on Windows that call services() or getDynamicData() with input an attacker can influence, such as a service name from a request or form. Applications that only call systeminformation with fixed local values, or that run on Linux or macOS, are not exposed through this path. The library opens no network port itself.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000626,"input_tokens":3478,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116576':13A,16A '-2026':12A,15A '5.33.16':89C,206C 'accept':128C 'access':165C 'account':157C 'allow':132C 'alter':167C 'applic':168C,190C 'ascii':41B,119C 'attack':56B,193C 'attacker-control':192C 'break':50B 'build':25B 'bypass':4A 'caller':96C 'caller-suppli':95C 'chang':164C 'ciminst':30B,105C 'command':146C 'consum':189C 'control':58B,194C 'craft':48B,133C 'cve':11A,14A 'data':169C 'delimit':131C 'depend':186C 'disrupt':171C 'enabl':6A 'execut':147C 'expos':178C 'express':143C,151C 'file':166C 'filter':31B,54B,106C,138C 'fix':203C 'forward':191C 'get':29B,104C 'get-ciminst':28B,103C 'getdynamicdata':66B,199C 'inform':83C 'inject':8A 'input':49B,134C,195C 'insert':93C 'issu':201C 'let':47B 'lib/processes.js':92C 'lib/util.js':113C 'librari':24B,84C 'mark':46B,125C 'may':161C 'name':35B,61B,99C 'network':180C 'node.js':17B,75B,86C,155C 'npm':23B 'os':82C 'packag':18B,175C 'pass':62B 'permiss':72B,159C 'permit':122C 'place':140C 'powershel':7A,27B,69B,102C,127C,142C 'prior':87C 'process':76B,108C,156C 'quot':3A,42B,120C 'quotat':45B,124C 'reachabl':185C 'read':162C 'remot':184C 'remov':118C 'run':68B,152C 'sanit':5A,38B,117C 'sanitizeshellstr':111C 'servic':34B,60B,64B,90C,98C,173C,181C,197C 'string':130C 'strip':39B 'suppli':97C 'system':80C 'systeminform':1A,19B,22B,77C 'termin':136C 'unicod':2A,44B,123C 'util.powershell':149C 'version':205C 'window':10A,20B,115C","nicknames":[],"mitigations":[],"who_affected":"Only Node.js applications on Windows that call services() or getDynamicData() with input an attacker can influence, such as a service name from a request or form. Applications that only call systeminformation with fixed local values, or that run on Linux or macOS, are not exposed through this path. The library opens no network port itself.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116576","severity":null,"published_at":"2026-10-26T21:18:13+00:00","modified_at":"2026-10-26T21:18:14+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}