PowerShell Command Injection in Systeminformation Library for Node.js

CVE-2026-116576

What is CVE-2026-116576?

The Systeminformation library for Node.js has a command injection vulnerability in the services() function, allowing crafted input to manipulate PowerShell commands. Despite the implementation of sanitizeShellString(), the library permits the use of Unicode quotes, which can lead an attacker to inject malicious PowerShell expressions. These expressions execute with the permissions of the Node.js process, potentially altering files, application data, or disrupting service operations. This issue is particularly concerning when the library is used in applications that forward user-controlled input. The vulnerability is resolved in version 5.33.16.

References