systeminformation: systeminformation: OS Command Injection in `fsSize()` allows arbitrary command execution on Windows.

cve CVE-2025-68154 2 sources, 2 claims · Watch

Red Hat writes:
systeminformation: systeminformation: OS Command Injection in `fsSize()` allows arbitrary command execution on Windows. the claim

What it is to other things

affectsmicrosoft/windows
NVD
affectssysteminformation/systeminformation
NVD
made_bymicrosoft
NVD
made_bysysteminformation
NVD

In words only, so not counted until a person confirms one:

affectssebhildebrandt/systeminformation
NVD says “sebhildebrandt · systeminformation”
made_bysebhildebrandt
NVD says “sebhildebrandt”

What each source says

PropertySourceSaidMeans here
Cvss
cvss
NVD8.1
receipt
Source
NVD
Its words
8.1
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-04 12:15 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "systeminformation",
            "vendor": "sebhildebrandt",
            "versions": [
              {
                "status": "affected",
                "version": "< 5.27.14"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*",
                "matchCriteriaId": "4E586FA2-BB8A-49BC-AB57-A8D3F539FCC2",
                "versionEndExcluding": "5.27.14",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch."
      },
      {
        "lang": "es",
        "value": "systeminformation es una biblioteca de información del sistema y del SO para node.js. En versiones anteriores a la 5.27.14, la función 'fsSize()' en systeminformation es vulnerable a la inyección de comandos del SO en sistemas Windows. El parámetro opcional 'drive' se concatena directamente en un comando de PowerShell sin sanitización, lo que permite la ejecución arbitraria de comandos cuando la entrada controlada por el usuario llega a esta función. La explotabilidad real depende de cómo las aplicaciones utilizan esta función. Si una aplicación no pasa entrada controlada por el usuario a 'fsSize()', no es vulnerable. La versión 5.27.14 contiene un parche."
      }
    ],
    "id": "CVE-2025-68154",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-68154",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-17T14:50:36.446709Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-16T19:16:00.257",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-78"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Cvss
cvss
Red Hat8.1
receipt
Source
Red Hat
Its words
8.1
Read by
field:cvss3_score
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-04 12:16 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-68154",
  "CWE": "CWE-78",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2422883",
  "bugzilla_description": "systeminformation: systeminformation: OS Command Injection in `fsSize()` allows arbitrary command execution on Windows.",
  "cvss3_score": "8.1",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-12-16T18:18:03Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68154.json",
  "severity": "important"
}
—
Cwe
cwe
Red HatCWE-78
receipt
Source
Red Hat
Its words
CWE-78
Read by
field:CWE
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-04 12:16 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-68154",
  "CWE": "CWE-78",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2422883",
  "bugzilla_description": "systeminformation: systeminformation: OS Command Injection in `fsSize()` allows arbitrary command execution on Windows.",
  "cvss3_score": "8.1",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-12-16T18:18:03Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68154.json",
  "severity": "important"
}
—
Product
product
NVDsysteminformation
receipt
Source
NVD
Its words
systeminformation
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-04 12:15 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "systeminformation",
            "vendor": "sebhildebrandt",
            "versions": [
              {
                "status": "affected",
                "version": "< 5.27.14"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*",
                "matchCriteriaId": "4E586FA2-BB8A-49BC-AB57-A8D3F539FCC2",
                "versionEndExcluding": "5.27.14",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch."
      },
      {
        "lang": "es",
        "value": "systeminformation es una biblioteca de información del sistema y del SO para node.js. En versiones anteriores a la 5.27.14, la función 'fsSize()' en systeminformation es vulnerable a la inyección de comandos del SO en sistemas Windows. El parámetro opcional 'drive' se concatena directamente en un comando de PowerShell sin sanitización, lo que permite la ejecución arbitraria de comandos cuando la entrada controlada por el usuario llega a esta función. La explotabilidad real depende de cómo las aplicaciones utilizan esta función. Si una aplicación no pasa entrada controlada por el usuario a 'fsSize()', no es vulnerable. La versión 5.27.14 contiene un parche."
      }
    ],
    "id": "CVE-2025-68154",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-68154",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-17T14:50:36.446709Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-16T19:16:00.257",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-78"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
Red Hatimportant
A flaw that can easily compromise confidentiality, integrity or availability.
receipt
Source
Red Hat
Its words
important
Read by
field:severity
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-04 12:16 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-68154",
  "CWE": "CWE-78",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2422883",
  "bugzilla_description": "systeminformation: systeminformation: OS Command Injection in `fsSize()` allows arbitrary command execution on Windows.",
  "cvss3_score": "8.1",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-12-16T18:18:03Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68154.json",
  "severity": "important"
}
high
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-04 12:15 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "systeminformation",
            "vendor": "sebhildebrandt",
            "versions": [
              {
                "status": "affected",
                "version": "< 5.27.14"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*",
                "matchCriteriaId": "4E586FA2-BB8A-49BC-AB57-A8D3F539FCC2",
                "versionEndExcluding": "5.27.14",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch."
      },
      {
        "lang": "es",
        "value": "systeminformation es una biblioteca de información del sistema y del SO para node.js. En versiones anteriores a la 5.27.14, la función 'fsSize()' en systeminformation es vulnerable a la inyección de comandos del SO en sistemas Windows. El parámetro opcional 'drive' se concatena directamente en un comando de PowerShell sin sanitización, lo que permite la ejecución arbitraria de comandos cuando la entrada controlada por el usuario llega a esta función. La explotabilidad real depende de cómo las aplicaciones utilizan esta función. Si una aplicación no pasa entrada controlada por el usuario a 'fsSize()', no es vulnerable. La versión 5.27.14 contiene un parche."
      }
    ],
    "id": "CVE-2025-68154",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-68154",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-17T14:50:36.446709Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-16T19:16:00.257",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-78"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDsebhildebrandt
receipt
Source
NVD
Its words
sebhildebrandt
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-04 12:15 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "systeminformation",
            "vendor": "sebhildebrandt",
            "versions": [
              {
                "status": "affected",
                "version": "< 5.27.14"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*",
                "matchCriteriaId": "4E586FA2-BB8A-49BC-AB57-A8D3F539FCC2",
                "versionEndExcluding": "5.27.14",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch."
      },
      {
        "lang": "es",
        "value": "systeminformation es una biblioteca de información del sistema y del SO para node.js. En versiones anteriores a la 5.27.14, la función 'fsSize()' en systeminformation es vulnerable a la inyección de comandos del SO en sistemas Windows. El parámetro opcional 'drive' se concatena directamente en un comando de PowerShell sin sanitización, lo que permite la ejecución arbitraria de comandos cuando la entrada controlada por el usuario llega a esta función. La explotabilidad real depende de cómo las aplicaciones utilizan esta función. Si una aplicación no pasa entrada controlada por el usuario a 'fsSize()', no es vulnerable. La versión 5.27.14 contiene un parche."
      }
    ],
    "id": "CVE-2025-68154",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-68154",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-17T14:50:36.446709Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-16T19:16:00.257",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-78"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—

vulnerability

systeminformation: systeminformation: OS Command Injection in `fsSize()` allows arbitrary command execution on Windows.
zetlyn/cve-redhat · 2025-12-16
cvss 8.1 cwe CWE-78 severity important source
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.
zetlyn/cve-nvd · 2025-12-16
cvss 8.1 product systeminformation status Analyzed vendor sebhildebrandt source