PT-2025-51775 · Unknown · Systeminformation

Published 2025-12-16 · Updated 2026-05-20 · CVE-2025-68154

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

systeminformation and Affected Versions systeminformation versions prior to 5.27.14

Description The fsSize() function within the systeminformation Node.js library is susceptible to OS command injection on Windows systems. The optional drive parameter is directly incorporated into a PowerShell command without proper sanitization, potentially enabling arbitrary command execution when user-supplied input reaches this function. The exploitability of this issue is contingent upon how applications utilize this function; applications that do not pass user-controlled input to fsSize() are not vulnerable. The drive parameter is concatenated directly into a PowerShell command string without any sanitization. This is inconsistent with other functions in the codebase that properly sanitize user input using util.sanitizeShellString(). Successful exploitation could lead to remote code execution, data exfiltration, and potentially privilege escalation. The issue affects applications running systeminformation on Windows that pass user-controlled input to fsSize(drive), including web applications, APIs, and monitoring dashboards.

Recommendations Apply util.sanitizeShellString() to the drive parameter, consistent with other functions in the codebase.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-68154

GHSA-WPHJ-FX3Q-84CH

Affected Products

Systeminformation

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68154.json · Exploit
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch · Vendor Advisory
• https://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68 · Patch
• https://osv.dev/vulnerability/CVE-2025-68154 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-68154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68154 · Security Note
• https://osv.dev/vulnerability/GHSA-wphj-fx3q-84ch · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-68154 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-68154 · Vendor Advisory
• https://github.com/sebhildebrandt/systeminformation · Note
• https://t.me/cveNotify/152468 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2001160452206694784 · Twitter Post
• https://twitter.com/CheckmarxZero/status/2001659476730839473 · Twitter Post
• https://twitter.com/threatcluster/status/2001613560519025023 · Twitter Post
• https://t.me/CVEtracker/39999 · Telegram Post