Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-68154
Good to know:
Date: December 16, 2025
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the "fsSize()" function in systeminformation is vulnerable to OS command injection on Windows systems. The optional "drive" parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to "fsSize()", it is not vulnerable. Version 5.27.14 contains a patch.
Severity Score
Related Resources (5)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78Top Fix
Upgrade Version
Upgrade to version systeminformation - 5.27.14;https://github.com/sebhildebrandt/systeminformation.git - v5.27.14
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | HIGH |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |