Description
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
Remediation
References
https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61
https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909
Related Vulnerabilities
CVE-2021-3807 Vulnerability in npm package ansi-regex
CVE-2020-6427 Vulnerability in maven package org.webjars.npm:electron
CVE-2018-18853 Vulnerability in maven package io.spray:spray-json_2.12
CVE-2021-28128 Vulnerability in npm package strapi
CVE-2019-17495 Vulnerability in maven package org.webjars:swagger-ui