{"id":"CVE-2020-26245","published":"2020-11-27T19:50:04Z","modified":"2024-08-04T15:56:03Z","title":"Prototype Pollution leading to Command Injection in systeminformation","vendor":"sebhildebrandt","product":"systeminformation","tier":"tail","description":{"text":"npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02229,"percentile":0.82748,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-471","name":"Modification of Assumed-Immutable Data (MAID)"}],"references":[{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4v2w-h9jm-mqjg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","tags":["x_refsource_MISC"]}],"priority":{"score":22.2,"factors":[{"name":"EPSS percentile","points":16.55},{"name":"CVSS severity","points":5.67}]},"vendorSlug":"sebhildebrandt","affectedVersions":[{"vendor":"sebhildebrandt","product":"systeminformation","versions":["< 4.30.5"]}],"affected":[{"ecosystem":"npm","package":"systeminformation","vulnerableRanges":["<4.30.5"],"patched":["4.30.5"],"from":["GHSA-4v2w-h9jm-mqjg"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-1444","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sebhildebrandt-systeminformation-cve-2020-7752","parents":[{"from":"CVE-2020-7778","to":"CVE-2020-26245","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"4.30.2","toFixed":"4.30.5","daysApart":1},{"kind":"same-code","provenance":"machine","files":["lib/internet.js","lib/processes.js","lib/util.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8"],"basis":"shared function","functions":["inetChecksite","isPrototypePolluted","networkStatsSingle","services"]}]},{"from":"CVE-2020-7752","to":"CVE-2020-26245","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61"],"basis":"shared function","functions":["inetChecksite"]}]}],"children":[{"from":"CVE-2020-26245","to":"CVE-2021-21315","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js","lib/processes.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525"],"basis":"shared function","functions":["inetChecksite","services"]}]},{"from":"CVE-2020-26245","to":"CVE-2021-21388","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js","lib/processes.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524","https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46"],"basis":"shared function","functions":["inetChecksite","networkStatsSingle","services"]},{"kind":"similar","provenance":"machine","score":0.36,"basis":"same product + CWE + description similarity"}]},{"from":"CVE-2020-26245","to":"CVE-2025-68154","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/util.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68"],"basis":"shared function","functions":["isPrototypePolluted"]}]},{"from":"CVE-2020-26245","to":"CVE-2026-116576","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/processes.js","lib/util.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/5014c6d25cfce7363b937977327baa853cdba0bf"],"basis":"shared function","functions":["services"]}]},{"from":"CVE-2020-26245","to":"CVE-2026-116673","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/network.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/8d294b3139fec654a912969ac898037578a218cd"],"basis":"shared function","functions":["networkStatsSingle"]}]}],"packageHistory":[{"cve":"CVE-2020-26300","published":"2021-09-09","fixed":"4.26.2","kev":false},{"cve":"CVE-2020-7752","published":"2020-10-26","fixed":"4.27.11","kev":false},{"cve":"CVE-2020-7778","published":"2020-11-26","fixed":"4.30.2","kev":false},{"cve":"CVE-2020-26245","published":"2020-11-27","fixed":"4.30.5","kev":false},{"cve":"CVE-2020-26274","published":"2020-12-16","fixed":"4.31.1","kev":false,"link":{"from":"CVE-2020-26245","to":"CVE-2020-26274","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"4.30.5","toFixed":"4.31.1","daysApart":19},{"kind":"same-code","provenance":"machine","files":["lib/util.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/1faadcbf68f1b1fdd5eb2054f68fc932be32ac99"],"basis":"shared file"}]}},{"cve":"CVE-2021-21315","published":"2021-02-16","fixed":"5.3.1","kev":true},{"cve":"CVE-2021-21388","published":"2021-04-29","fixed":"5.6.4","kev":false}],"package":"npm:systeminformation"}}