The systeminformation library for Node.js contains a critical command injection vulnerability that allows unauthenticated attackers to execute arbitrary OS commands with the privileges of the host process.

This is an OS Command Injection (CWE-78) flaw located in the wifiNetworks function of lib/wifi.js. An attacker can trigger the vulnerability by providing malicious input to the iface parameter, which is improperly sanitized during the retry code path, leading to direct execution of commands via execSync.

The vulnerability carries a CVSS score of 8.4, reflecting the potential for full system compromise. Successful exploitation allows an attacker to execute arbitrary commands, which may result in unauthorized data access, lateral movement within the network, or complete takeover of the server hosting the Node.js application.

Immediate Action: Update the systeminformation library to version 5.30.8 or later immediately.

Proactive Monitoring: Review application logs for unexpected shell commands or suspicious processes originating from the Node.js service account.

Compensating Controls: Implement strict input validation on all user-supplied data passed to the systeminformation library to ensure that characters used for command injection are blocked.

Public Exploit Available: Unknown

The severity of this command injection vulnerability necessitates an immediate update to version 5.30.8. Organizations relying on this library should prioritize this patch as part of their standard security maintenance cycle to prevent potential remote code execution and full system compromise.