Advisory Weakness Curation

systeminformation command injection vulnerability ### Impact command injection vulnerability ### Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.27.11 ### Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite() ### References _Are there any links users can visit to find out more?_ ### For more information If you have any questions or comments about this advisory: * Open an issue in systeminformation https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md

The systeminformation package is vulnerable to Command Injection. An attacker can concatenate the curl command's parameters to overwrite Javascript files and then execute any OS commands.