CVE-2026-116576: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
On Windows, systeminformation@5.33.15 builds a PowerShell command using the value passed to services(). The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter string and run a PowerShell expression. The expression runs with the permissions of the Node.js process.
This report confirms version 5.33.15. Other package versions have not been checked.
References
- github.com/advisories/GHSA-3f7j-7jwc-fxfj
- github.com/sebhildebrandt/systeminformation/commit/5014c6d25cfce7363b937977327baa853cdba0bf
- github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.16
- github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-3f7j-7jwc-fxfj
- nvd.nist.gov/vuln/detail/CVE-2026-116576
Code Behaviors & Features
Detect and mitigate CVE-2026-116576 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →