{"id":"EUVD-2025-203835","enisaUuid":"95e21cb6-7248-3d99-bc75-d344b9b0ffa8","description":"systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.","datePublished":"Dec 16, 2025, 6:18:03 PM","dateUpdated":"Dec 17, 2025, 6:50:42 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch\nhttps://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68\n","aliases":"CVE-2025-68154\nGHSA-wphj-fx3q-84ch\n","assigner":"GitHub_M","epss":12.99,"enisaIdProduct":[{"id":"6a2cb577-6987-3fce-adb4-dfccf1ad8ecf","product":{"name":"systeminformation","vendor":{"name":"sebhildebrandt"}},"product_version":"\u003c 5.27.14"}],"enisaIdVendor":[{"id":"1d67f011-2500-3739-8a75-c3e3365b7ed9","vendor":{"name":"sebhildebrandt"}}],"enisaIdVulnerability":[{"id":"63570fae-2e8f-3e34-9008-eabd2ada0513","vulnerability":{"id":"CVE-2025-68154","description":"systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.","datePublished":"Dec 16, 2025, 6:18:03 PM","dateUpdated":"Dec 17, 2025, 6:50:42 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch\nhttps://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68\n","enisa_id":"EUVD-2025-203835\n","assigner":"GitHub_M","epss":12.99,"dataProcessed":"Oct 27, 2026, 7:13:41 AM","vulnerabilityProduct":[{"id":"c6ef0c4c-7af1-343a-bba9-8d897878073f","product":{"name":"systeminformation","vendor":{"name":"sebhildebrandt"}},"product_version":"\u003c 5.27.14"}],"vulnerabilityVendor":[{"id":"ead57fa9-2b7c-33d0-85e4-2d6b5232b027","vendor":{"name":"sebhildebrandt"}}]}},{"id":"9af0f85e-68f0-3766-b5f5-4d69ebc8c22d","vulnerability":{"id":"GHSA-wphj-fx3q-84ch","description":"systeminformation has a Command Injection vulnerability in fsSize() function on Windows","datePublished":"Dec 16, 2025, 10:37:23 PM","dateUpdated":"Dec 16, 2025, 10:37:23 PM","baseScore":0.0,"references":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68154\nhttps://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68\nhttps://github.com/sebhildebrandt/systeminformation\n","enisa_id":"EUVD-2025-203835\n","aliases":"GHSA-wphj-fx3q-84ch\nCVE-2025-68154\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:52:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}