A critical OS command injection vulnerability in the systeminformation library for Node.js may allow unauthenticated attackers to achieve arbitrary command execution on Windows systems.

This vulnerability occurs due to improper neutralization of special elements in the fsSize function, where the drive parameter is concatenated into a PowerShell command without sanitization. The flaw permits unauthenticated attackers to inject malicious commands if user-controlled input is passed to this function.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the Node.js application, potentially leading to full system compromise. Given the CVSS score of 8.1, this represents a high-severity risk that could result in unauthorized data access, system disruption, and lateral movement within the network.

Immediate Action: Update the systeminformation package to version 5.27.14 or later to apply the necessary input sanitization.

Proactive Monitoring: Review application code to determine if user-controlled input is passed to the fsSize function and monitor system logs for suspicious PowerShell process executions.

Compensating Controls: Ensure the Node.js application runs with the least privilege necessary to limit the impact of potential command execution.

Public Exploit Available: No

The presence of an OS command injection flaw necessitates immediate attention, especially in environments where the systeminformation library processes external input. Organizations should prioritize updating to version 5.27.14 as the primary mitigation strategy to eliminate the vulnerability at the source.