Description (CNA)
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / systeminformation | affected unspecified before 4.27.11 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909
- https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
- https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61
ADP enrichment
No English description supplied.