systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.
Historical advisory saved 28 Oct 2026 02:54:19 UTC. The publisher may have updated it since then. Latest advisory.
euvd · EUVD-2026-8239
Publishedsysteminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Feb 19, 2026, 7:48:55 PM
dateUpdated: Jul 15, 2026, 1:15:02 AM
- Source published
- Feb 19, 2026, 7:48:55 PM (timezone not stated)
- Source modified
- Jul 15, 2026, 1:15:02 AM (timezone not stated)
- Saved here
- 28 Oct 2026 02:54:19 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 3.1 · 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H