Command Injection Vulnerability in systeminformation
CVE-2020-26274

6.4MEDIUM

Key Information:

Vendor

Sebhildebrandt

Status
Systeminformation
Vendor
CVE Published:
16 December 2020

What is CVE-2020-26274?

In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.

Affected Version(s)

systeminformation < 4.31.1

References

https://github.com/sebhildebrandt/systeminformation/secur...
x_refsource_CONFIRM
https://github.com/sebhildebrandt/systeminformation/commi...
x_refsource_MISC
https://www.npmjs.com/package/systeminformation
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.