CVE-2025-68154: systeminformation command injection in fsSize on Windows

CVE-2025-68154 · Severity: high · CVSS 8.1 · Published 2025-12-16

systeminformation is a Node.js library used to retrieve system hardware and software information. The fsSize() function on Windows systems contains a command injection flaw that allows arbitrary OS command execution if an application passes user-controlled input to this function. An attacker could exploit this to execute malicious commands with the privileges of the Node.js process.

Technologies: Microsoft Windows, systeminformation (npm). Vendors: Microsoft, npm, Systeminformation.

Quick answers

Is CVE-2025-68154 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-68154 being exploited in the wild.
How severe is CVE-2025-68154?
High severity, with a CVSS score of 8.1, published 16 December 2025.
Which products and versions are affected?
systeminformation (npm) SEMVER:introduced=0,fixed=5.27.14.
Is there a fix for CVE-2025-68154?
Yes. systeminformation (npm): upgrade to 5.27.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68154 attacked?
It is attacked over the network.
Am I affected by CVE-2025-68154?
Check whether you run Microsoft Windows, systeminformation (npm) or Systeminformation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • systeminformation (npm): upgrade to 5.27.14 or later
    npm install systeminformation@5.27.14

Technical details

The fsSize() function on Windows directly concatenates an optional drive parameter into a PowerShell command string without sanitization, enabling OS command injection (CWE-78). The vulnerable code constructs a Get-WmiObject PowerShell query by appending user input via string concatenation. An attacker can use semicolons and other shell metacharacters to break out of the intended command and inject arbitrary PowerShell commands. Exploitation requires the application to pass user-controlled input to fsSize(); if an app only calls fsSize() with static parameters or no parameters, it is not vulnerable. The codebase already uses a util.sanitizeShellString() function in other similar functions, but this was not applied in fsSize(). A patch was released in version 5.27.14 that applies proper input sanitization.

Affected products

  • systeminformation systeminformation <=5.27.13

Identifiers

  • CVE-2025-68154
  • GHSA-wphj-fx3q-84ch

Timeline

  • 2025-12-16: disclosed: Advisory GHSA-wphj-fx3q-84ch published
  • 2025-12-16: patched: Version 5.27.14 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.