systeminformation CVE-2025-68154

Two concrete preconditions must both hold: (1) the Node.js process runs on Windows (win32) - the vulnerable branch uses PowerShell Get-WmiObject Win32_logicaldisk and does not exist on Linux/macOS/BSD; and (2) the host application passes attacker-controlled input into the optional drive parameter of si.fsSize(), for example a web/API endpoint that reports disk info for a user-named volume. What limits exploitation: applications that call fsSize() with no argument or with a hardcoded/internal drive value are NOT vulnerable, and non-Windows deployments are NOT vulnerable. No authentication is required at the library level (PR:N), but the dependency on application data flow is precisely why CVSS assigns AC:H.

Signals conflict on how easily this is exploited. The CVSS base score is 8.1 (High) with AV:N/PR:N/UI:N, but the decisive metric is AC:H - and the GHSA advisory is explicit that AC:H reflects the hard precondition: the host application must plumb attacker-controlled input into the optional drive argument of fsSize(), AND the process must be running on Windows. The vulnerability is inert on Linux/macOS/BSD and inert on any app that passes a fixed/internal drive value (the overwhelmingly common usage). So the 8.1 overstates typical real-world exposure: it is a genuine code-level command-injection flaw but a conditional, deployment-dependent one rather than a blanket remote-unauth RCE. Exploitation status is 'publicly available exploit code exists' (the GHSA advisory ships a PoC) - but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active exploitation; treat PoC availability and active exploitation as distinct signals. No SSVC decision data was provided. Priority is real for the narrow population of Windows Node.js services that expose disk/filesystem lookups with user-supplied drive names; for everyone else this is a low-urgency dependency-hygiene update.

A Node.js web app running on Windows exposes an API that reports disk usage and passes a user-supplied drive/volume name straight into si.fsSize(drive). An unauthenticated attacker submits a drive value containing PowerShell metacharacters (e.g. terminating the Get-WmiObject pipeline and appending their own command), which is concatenated unsanitized and executed by powerShell() in the Node.js process context, yielding arbitrary command execution. A public PoC exists in the GHSA advisory, but the attack only works where the application actually forwards user input to this parameter on a Windows host.