CVE-2026-116576: systeminformation PowerShell command injection via Unicode quotation marks

CVE-2026-116576 · Severity: high · CVSS 7.8 · Published 2026-10-26

systeminformation is a Node.js library that retrieves system and operating system information. On Windows systems, an attacker can supply crafted service names to the services() function that bypass the shell sanitizer using Unicode quotation marks, allowing arbitrary PowerShell commands to execute with the Node.js process privileges. This can lead to file manipulation, data theft, or disruption of services if an application exposes this library to untrusted input.

Technologies: systeminformation (npm). Vendors: npm, Systeminformation.

Quick answers

Is CVE-2026-116576 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116576 being exploited in the wild.
How severe is CVE-2026-116576?
High severity, with a CVSS score of 7.8, published 26 October 2026.
Which products and versions are affected?
systeminformation (npm) < 5.33.16, SEMVER:introduced=0,fixed=5.33.16; Systeminformation before 5.33.16.
Is there a fix for CVE-2026-116576?
Yes. systeminformation (npm): upgrade to 5.33.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116576 attacked?
It is attacked over the network.
Am I affected by CVE-2026-116576?
Check whether you run systeminformation (npm) or Systeminformation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • systeminformation (npm): upgrade to 5.33.16 or later
    npm install systeminformation@5.33.16

Technical details

The services() function in lib/processes.js passes caller-supplied service names into PowerShell Get-CimInstance filters after sanitization with sanitizeShellString(). The Windows sanitizer removes only ASCII quotes but permits Unicode quotation marks (such as U+201C and U+201D) that PowerShell accepts as string delimiters, enabling command injection. An attacker crafting a malicious service name can break out of the filter context and inject arbitrary PowerShell expressions executed by util.powerShell() with the Node.js process account permissions. Remote exploitation requires a consuming application to forward attacker-controlled input to services() or getDynamicData().

Affected products

  • systeminformation systeminformation before 5.33.16

Identifiers

  • CVE-2026-116576
  • GHSA-3f7j-7jwc-fxfj

Timeline

  • 2026-10-26: disclosed
  • 2026-10-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.