A command injection vulnerability in the systeminformation library for Node.js allows local attackers to achieve full system compromise.

The library fails to properly sanitize output from the locate command, enabling OS command injection. This vulnerability requires low privileges to exploit, as indicated by the CVSS vector PR:L.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the host operating system with the privileges of the application process. Given the CVSS score of 8.8, this poses a significant risk of total system compromise, including unauthorized data access, lateral movement within the network, and potential service disruption.

Immediate Action: Update the systeminformation package to version 5.31.0 or later via your package manager.

Proactive Monitoring: Monitor server logs for unexpected process execution or suspicious shell commands originating from the Node.js application environment.

Compensating Controls: Ensure the application runs with the least privilege necessary to limit the impact of a potential command execution event.

Public Exploit Available: No.

This vulnerability represents a high-severity risk due to the potential for complete system takeover. Administrators should prioritize updating the systeminformation dependency to version 5.31.0 immediately to mitigate the risk of OS command injection. Failure to patch may expose the host system to unauthorized manipulation and persistent compromise.