GHSA-wphj-fx3q-84ch — systeminformation has a Command Injection vulnerability in fsSize() function on Windows

Affected: npm: systeminformation

## Summary

The `fsSize()` function in `systeminformation` is vulnerable to **OS Command Injection (CWE-78)** on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function.

**Affected Platforms:** Windows only

**CVSS Breakdown:** - **Attack Vector (AV:N):** Network - if used in a web application/API - **Attack Complexity (AC:H):** High - requires application to pass user input to `fsSize()` - **Privileges Required (PR:N):** None - no authentication required at library level - **User Interaction (UI:N):** None - **Scope (S:U):** Unchanged - executes within Node.js process context - **Confidentiality/Integrity/Availability (C:H/I:H/A:H):** High impact if exploited

> **Note:** The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable.

---

## Details

### Vulnerable Code Location

**File:** `lib/filesystem.js`, **Line 197**

```javascript if (_windows) { try { const cmd = `Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size ${drive ? '| where -property Caption -eq ' + drive : ''} | fl`; util.powerShell(cmd).then((stdout, error) => { ```

The `drive` parameter is concatenated directly into the PowerShell command string without any sanitization.

### Why This Is a Vulnerability

This is…

Most recent entries from all

GHSA-wphj-fx3q-84ch — systeminformation has a Command Injection vulnerability in fsSize() function on Windows