---
id: "CVE-2026-116576"
kind: "vulnerability"
aliases: ["CVE-2026-116576"]
title: "systeminformation: Unicode quotes bypass sanitizer, enabling PowerShell injection on Windows"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node.js", "package", "systeminformation", "windows"]
not_affected_if: ["default-config", "linux-or-macos-only", "no-user-controlled-service-name"]
published_at: "2026-10-26T21:18:13+00:00"
first_seen_at: "2026-10-26T21:20:31+00:00"
updated_at: "2026-10-26T21:21:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116576", "first_seen_at": "2026-10-26T21:20:31+00:00"}]
---

# systeminformation: Unicode quotes bypass sanitizer, enabling PowerShell injection on Windows

The systeminformation npm library builds a PowerShell Get-CimInstance filter from a service name and its sanitizer strips only ASCII quotes, so Unicode quotation marks let crafted input break out of the filter. An attacker who controls the service name passed to services() or getDynamicData() can run PowerShell with the permissions of the Node.js process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls systeminformation` in each project to find the installed version.
- Check whether application code passes user-controlled input to `si.services()` or `si.getDynamicData()` on Windows.

## Fix

- Upgrade the systeminformation package to `5.33.16` or later.

## Timeline

- 2026-10-26T21:20:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116576

## From the sources

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_