CVE-2020-7778
Prototype Pollution
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Prototype Pollution
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
- Record
CVE-2020-7778- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O - Updated
- 2026-11-02
EUVDEUVD-2022-0919
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
- Record
EUVD-2022-0919- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8j36-q8x7-pm6q
OS Command Injection in systeminformation
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
- Record
GHSA-8j36-q8x7-pm6q- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
- Record
CVE-2020-7778- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
- Record
CVE-2020-7778- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-7778
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
- Record
DEBIAN-CVE-2020-7778- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-8j36-q8x7-pm6q
OS Command Injection in systeminformation
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
- Record
GHSA-8j36-q8x7-pm6q- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
systeminformationnpm |
before 4.30.2 | 4.30.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7778 is a high vulnerability (CVSS 7.3) in Sebhildebrandt Systeminformation, published November 26, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in systeminformation 4.30.2.
References
github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753
gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80
nvd.nist.gov/vuln/detail/CVE-2020-7778
security-tracker.debian.org/tracker/CVE-2020-7778