systeminformation CVE-2026-116576

Windows-only: the injection lives in the Windows branch of services() that builds a Get-CimInstance Win32_Service -Filter command and runs it via util.powerShell(); Linux/macOS are unaffected. The attacker must be able to control the service-name string passed to services() or to getDynamicData(), and a consuming application must forward that attacker-controlled input to the API because the package exposes no network service of its own. The specific trigger is supplying Unicode curly double quotes (U+201C/U+201D) - which the default, non-strict sanitizer leaves intact along with spaces and parentheses - to close the filter string and inject a PowerShell expression. Limiting factors: no built-in network exposure (remote reach is entirely a property of the downstream app), Windows platform required, versions <5.33.16 only, and resulting privileges are capped at whatever account the Node.js process runs under.

Signals point to a genuine but bounded risk rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8) reflects a local-input command-injection yielding full read/write/availability impact under the Node.js process account, not a directly network-reachable flaw. The library exposes no network service, so remote exploitation is not intrinsic - the reporter explicitly could not find a network route in the repository and states remote reachability depends on a consuming application forwarding attacker-controlled input to services()/getDynamicData(). EPSS is very low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation; this is consistent with a vulnerability whose exploitability is contingent on how downstream applications wire untrusted input. Against that, a concrete working proof-of-concept is published in the GHSA advisory and was reproduced by the reporter on Windows, and the vuln.today decision label is 'this_week', so it warrants prompt patching rather than deferral. Net: a real but conditional, Windows-only, operator/deployment-dependent issue - treat it as a this-week patch, not a drop-everything event. Note the apparent AV:L vs. 'could be made network-reachable' tension is resolved by the evidence: the package itself is local, and any network exposure comes from the consumer, not systeminformation.

A Windows application built on systeminformation (<5.33.16) passes a user- or request-supplied service name to services(). An attacker submits a name containing Unicode curly quotation marks (U+201C/U+201D) plus a PowerShell expression; the default sanitizer strips ASCII quotes but leaves the Unicode quotes, so the input terminates the Get-CimInstance -Filter string and the attacker's expression executes as the Node.js process account. A working PoC that creates a marker file via New-Item is published in the GHSA advisory and was reproduced by the reporter on Windows.