CVE-2023-42810: systeminformation SSID Command Injection Vulnerability

September 21, 2023 (updated September 23, 2023)

Impact

SSID Command Injection Vulnerability

Patches

Problem was fixed with a parameter check. Please upgrade to version >= 5.21.7, Version 4 was not affected

Workarounds

If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to wifiConnections(), wifiNetworks() (string only)

References

github.com/advisories/GHSA-gx6r-qc2v-3p3v
github.com/sebhildebrandt/systeminformation/commit/7972565812ccb2a610a22911c54c3446f4171392
github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-gx6r-qc2v-3p3v
systeminformation.io/security.html

Code Behaviors & Features

Detect and mitigate CVE-2023-42810 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →