CVE-2020-26300
Command injection in systeminformation
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Command injection in systeminformation
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
- Record
CVE-2020-26300- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2020-1428
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
- Record
EUVD-2020-1428- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fj59-f6c3-3vw4
Command Injection in systeminformation
Impact
command injection vulnerability
Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2
Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to is.services(), is.inetChecksite(), si.inetLatency(), si.networkStats(), is.services() and si.processLoad()
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
- Open an issue in systeminformation
- Record
GHSA-fj59-f6c3-3vw4- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
- Record
CVE-2020-26300- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
OSV
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
- Record
CVE-2020-26300- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-26300
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
- Record
DEBIAN-CVE-2020-26300- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-fj59-f6c3-3vw4
Command Injection in systeminformation
Impact
command injection vulnerability
Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2
Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to is.services(), is.inetChecksite(), si.inetLatency(), si.networkStats(), is.services() and si.processLoad()
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
- Open an issue in systeminformation
- Record
GHSA-fj59-f6c3-3vw4- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
systeminformationnpm |
before 4.26.2 | 4.26.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-26300 is a medium vulnerability (CVSS 5.9) in Sebhildebrandt Systeminformation, published October 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in systeminformation 4.26.2.
References
npmjs.com/package/systeminformation
github.com/advisories/GHSA-fj59-f6c3-3vw4
nvd.nist.gov/vuln/detail/CVE-2020-26300
security-tracker.debian.org/tracker/CVE-2020-26300