high7.3
CVE-2020-7778
OS Command Injection in systeminformation
Impact
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | systeminformation | < 4.30.2 | 4.30.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Systeminformation | Systeminformation | before 4.30.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80
- https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
- https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc
- https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc
- https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753
- https://github.com/advisories/GHSA-8j36-q8x7-pm6q
- https://nvd.nist.gov/vuln/detail/CVE-2020-7778