Threats tagged 'ghsa-3f7j-7jwc-fxfj'

The systeminformation package version 5.33.15 on Windows is vulnerable to command injection via the services() function. The vulnerability arises because the sanitizer removes ASCII quotes but not Unicode curly quotes, allowing crafted input to break out of a PowerShell filter string and execute arbitrary commands with the Node.js process permissions. This can lead to unauthorized command execution if attacker-controlled input reaches services(). The issue is fixed in version 5.33.16.