{"id":"CVE-2026-116576","aliases":["GHSA-3f7j-7jwc-fxfj"],"title":"systeminformation: Windows command injection in services() through Unicode quotation marks","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Summary\n\nOn Windows, `systeminformation@5.33.15` builds a PowerShell command using the value passed to `services()`. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter string and run a PowerShell expression. The expression runs with the permissions of the Node.js process.\n\nThis report confirms version `5.33.15`. Other package versions have not been checked.\n\n### Details\n\nIn `lib/processes.js`, `services()` sanitizes the caller's string with `sanitizeShellString()` and later inserts each resulting name into a `Get-CimInstance Win32_Service -Filter` command. The Windows branch passes that command to `util.powerShell()`.\n\nThe sanitizer in `lib/util.js` removes the ASCII double quote, but it does not remove U+201C or U+201D, the left and right curly double quotation marks. It also permits spaces and parentheses when called in its default, non-strict mode. PowerShell accepts the curly marks as string delimiters, so an input can end the filter string and place a command expression in the generated command.\n\nFor example, the input below uses curly quotation marks to end the generated filter string and execute `New-Item`. I reproduced this call on Windows against the checked-out `systeminformation@5.33.15` source; it created a marker file with the Node.js process account.\n\n### Proof of concept\n\nRun this on Windows in a disposable directory with Node.js and PowerShell available:\n\n```powershell\nmkdir si-command-injection-repro\ncd si-command-injection-repro\nnpm init -y\nnpm install systeminformation@5.33.15\n```\n\nSave the following as `poc.cjs`, then run `node poc.cjs`:\n\n```js\n'use strict';\n\nconst fs = require('node:fs');\nconst path = require('node:path');\nconst si = require('systeminformation');\n\n(async () => {\n  const markerName = `si-injection-${process.pid}.txt`;\n  const markerPath = path.join(process.cwd(), markerName);\n  fs.rmSync(markerPath, { force: true });\n\n  try {\n    await si.services(`not-a-service” (New-Item -Name ${markerName} -ItemType File -Force) “`);\n    console.log(`markerCreated=${fs.existsSync(markerPath)}`);\n  } finally {\n    fs.rmSync(markerPath, { force: true });\n  }\n})().catch((error) => {\n  console.error(error);\n  process.exitCode = 1;\n});\n```\n\nExpected output:\n\n```text\nmarkerCreated=true\n```\n\nThe Windows run returned an array and created the marker (`markerCreated: true`). A benign input left the marker absent. The script removes the marker afterward. I did not identify an application network route that forwards remote input to `services()`, so remote exploitability depends on the consuming application.\n\n### Impact\n\nAn application that passes attacker-controlled input to `services()` on Windows can execute PowerShell commands with the Node.js process account's permissions. Depending on that account, commands may read or change accessible files, alter application data, or disrupt the service. I searched this repository for HTTP servers, route handlers, and listener calls and found none. `services()` is exposed through the package API and `getDynamicData()`, so a consuming application could make the input network-reachable if it forwards request data. A separate loopback HTTP harness did trigger the command through a query parameter, but that server was test code and is not part of this repository. The project's `docs/security.html` already warns that arbitrary untrusted input to `services()` needs caution because package sanitization does not cover every case.","severity":"high","score":7.8,"published":"2026-10-26T20:18:33.224Z","modified":"2026-10-28T23:00:04.050Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"systeminformation","sources":[{"name":"OSV · GHSA-3f7j-7jwc-fxfj","url":"https://osv.dev/vulnerability/GHSA-3f7j-7jwc-fxfj"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.33.16"}],"type":"SEMVER"}],"versions":[],"fixed":["5.33.16"]}],"sourceAffected":[],"references":["https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-3f7j-7jwc-fxfj","https://github.com/sebhildebrandt/systeminformation/commit/5014c6d25cfce7363b937977327baa853cdba0bf","https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.16","https://nvd.nist.gov/vuln/detail/CVE-2026-116576","https://github.com/sebhildebrandt/systeminformation"],"sources":[{"name":"CVE","id":"CVE-2026-116576","modified":"2026-10-26T20:18:33.224Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116576"},{"name":"OSV","id":"GHSA-3f7j-7jwc-fxfj","modified":"2026-10-28T23:00:04.050952274Z","url":"https://osv.dev/vulnerability/GHSA-3f7j-7jwc-fxfj"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},{"source":"OSV","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"cve":{"records":[{"id":"CVE-2026-116576","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-26T15:03:39.035Z","published":"2026-10-26T20:18:33.224Z","modified":"2026-10-26T20:18:33.224Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-26T20:18:33.224Z"}],"references":[{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-3f7j-7jwc-fxfj","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/5014c6d25cfce7363b937977327baa853cdba0bf","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.16","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-78","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"sebhildebrandt","name":"systeminformation","platforms":[],"versions":[{"version":"< 5.33.16","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-116576"}],"remediation":[],"observedAt":"2026-10-29T14:55:45.754Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T08:35:32.065Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T23:25:43.724Z","attemptedAt":"2026-10-28T23:25:43.724Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T23:25:44.383Z","attemptedAt":"2026-10-28T23:25:44.383Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T23:25:41.628Z","attemptedAt":"2026-10-28T23:25:41.628Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T23:25:44.445Z","attemptedAt":"2026-10-28T23:25:44.445Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-110317","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110317","modified":"Oct 28, 2026, 10:42:49 PM","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T23:25:41.628Z"},{"source":"NVD","id":"CVE-2026-116576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116576","modified":"2026-10-26T21:18:14.050","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T23:25:43.724Z"},{"source":"GitHub Advisory Database","id":"GHSA-3f7j-7jwc-fxfj","url":"https://github.com/advisories/GHSA-3f7j-7jwc-fxfj","modified":"2026-10-28T22:42:50Z","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T23:25:44.383Z"},{"source":"FIRST EPSS","id":"CVE-2026-116576","url":"https://www.first.org/epss/","probability":0.00145,"percentile":0.03759,"date":"2026-10-28","checkedAt":"2026-10-28T23:25:44.445Z"}],"aiSummary":{"text":"The systeminformation package, version 5.33.15, has a command injection vulnerability on Windows. An attacker with access to the services() function can execute PowerShell commands with the Node.js process account's permissions. The vulnerability occurs due to incomplete sanitization of input strings.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:44:51.367Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-116576"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-3f7j-7jwc-fxfj"}]}}