{"id":"CVE-2020-26274","published":"2020-12-16T19:30:18Z","modified":"2024-08-04T15:56:03Z","title":"Command Injection Vulnerability in systeminformation","vendor":"sebhildebrandt","product":"systeminformation","tier":"tail","description":{"text":"In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02745,"percentile":0.86153,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-m57p-p67h-mq74","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/1faadcbf68f1b1fdd5eb2054f68fc932be32ac99","tags":["x_refsource_MISC"]},{"url":"https://www.npmjs.com/package/systeminformation","tags":["x_refsource_MISC"]}],"priority":{"score":21.7,"factors":[{"name":"EPSS percentile","points":17.23},{"name":"CVSS severity","points":4.48}]},"vendorSlug":"sebhildebrandt","affectedVersions":[{"vendor":"sebhildebrandt","product":"systeminformation","versions":["< 4.31.1"]}],"affected":[{"ecosystem":"npm","package":"systeminformation","vulnerableRanges":["<4.31.1"],"patched":["4.31.1"],"from":["GHSA-m57p-p67h-mq74"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-1498","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sebhildebrandt-systeminformation-cve-2020-7752","parents":[{"from":"CVE-2020-26245","to":"CVE-2020-26274","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"4.30.5","toFixed":"4.31.1","daysApart":19},{"kind":"same-code","provenance":"machine","files":["lib/util.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/1faadcbf68f1b1fdd5eb2054f68fc932be32ac99"],"basis":"rarely changed file"}]},{"from":"CVE-2020-7778","to":"CVE-2020-26274","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/util.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/1faadcbf68f1b1fdd5eb2054f68fc932be32ac99","https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8"],"basis":"shared function","functions":["sanitizeShellString"]}]}],"packageHistory":[{"cve":"CVE-2020-7752","published":"2020-10-26","fixed":"4.27.11","kev":false},{"cve":"CVE-2020-7778","published":"2020-11-26","fixed":"4.30.2","kev":false},{"cve":"CVE-2020-26245","published":"2020-11-27","fixed":"4.30.5","kev":false},{"cve":"CVE-2020-26274","published":"2020-12-16","fixed":"4.31.1","kev":false},{"cve":"CVE-2021-21315","published":"2021-02-16","fixed":"5.3.1","kev":true},{"cve":"CVE-2021-21388","published":"2021-04-29","fixed":"5.6.4","kev":false},{"cve":"CVE-2023-42810","published":"2023-09-21","fixed":"5.21.7","kev":false}],"package":"npm:systeminformation"}}