What is GHSA-fj59-f6c3-3vw4?

GHSA-fj59-f6c3-3vw4 is a security advisory published by GitHub Security Advisories with Medium severity. Command Injection in systeminformation

Which CVE IDs does GHSA-fj59-f6c3-3vw4 cover?

GHSA-fj59-f6c3-3vw4 covers the following CVE IDs: CVE-2020-26300. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fj59-f6c3-3vw4?

GHSA-fj59-f6c3-3vw4 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-fj59-f6c3-3vw4?

GHSA-fj59-f6c3-3vw4 affects 1 product, including: npm/systeminformation:\u003c 4.26.2.

GHSA-fj59-f6c3-3vw4MediumCVSS 5.9

Command Injection in systeminformation

Vendor

GitHub Security Advisories

Published

October 27, 2020

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-26300 →

📋 Description

Impact

command injection vulnerability

Patches

Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2

Workarounds

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to is.services(), is.inetChecksite(), si.inetLatency(), si.networkStats(), is.services() and si.processLoad()

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

Open an issue in systeminformation

🎯 Affected products1

npm/systeminformation:< 4.26.2

🔗 References (5)

https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-fj59-f6c3-3vw4
https://github.com/sebhildebrandt/systeminformation/commit/bad372e654cdd549e7d786acbba0035ded54c607
https://www.npmjs.com/package/systeminformation
https://nvd.nist.gov/vuln/detail/CVE-2020-26300
https://github.com/advisories/GHSA-fj59-f6c3-3vw4