CVE-2025-68154
📋 TL;DR
CVE-2025-68154 is an OS command injection vulnerability in the systeminformation library for Node.js. On Windows systems, the fsSize() function improperly concatenates user input into PowerShell commands without sanitization, allowing attackers to execute arbitrary commands. Applications using affected versions of systeminformation that pass user-controlled input to fsSize() are vulnerable.
💻 Affected Systems
- systeminformation
📦 What is this software?
Systeminformation by Systeminformation
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Limited command execution within the context of the Node.js application, potentially allowing lateral movement or data exfiltration.
If Mitigated
No impact if applications don't pass user input to fsSize() or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires user input to reach the vulnerable function, which depends on application implementation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.27.14
Vendor Advisory: https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84ch
Restart Required: No
Instructions:
1. Update systeminformation package to version 5.27.14 or later. 2. Run 'npm update systeminformation' or update package.json dependency. 3. Restart Node.js applications using the library.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for the drive parameter before passing to fsSize()
Function Restriction
allAvoid passing user-controlled input to fsSize() function entirely
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user input passed to fsSize()
- Run Node.js applications with minimal privileges and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check if systeminformation version is below 5.27.14 and if application passes user input to fsSize()Check Version:
npm list systeminformationVerify Fix Applied:
Verify systeminformation version is 5.27.14 or higher using npm list systeminformation📡 Detection & Monitoring
Log Indicators:
- Unusual PowerShell execution from Node.js processes
- Unexpected system commands executed by Node.js applications
Network Indicators:
- Unusual outbound connections from Node.js processes
- Command and control traffic patterns
SIEM Query:
Process execution where parent_process contains 'node.exe' AND process_command_line contains 'powershell' AND process_command_line contains unusual parameters