CVE-2026-116576 sebhildebrandt CVE debrief

Who should care

Defenders responsible for systems using the systeminformation package, especially those in environments where version 5.33.15 is deployed, should assess their exposure and prioritize remediation or compensating controls to mitigate potential command injection attacks.

Why it matters

This vulnerability in the systeminformation package allows for command injection on Windows systems, potentially leading to unauthorized execution of PowerShell expressions with Node.js process permissions. Defenders should prioritize verifying system exposure, assessing remediation feasibility, and monitoring for suspicious activity.

• Verify if systems using the affected package version are exposed to potential command injection attacks.
• Assess the feasibility of upgrading to a patched version or applying compensating controls to mitigate the vulnerability.
• Monitor system logs for suspicious activity that may indicate exploitation attempts.

Technical summary

The systeminformation package, specifically version 5.33.15 on Windows, is vulnerable to command injection due to the services() function's improper sanitization of input. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses, allowing an attacker to craft a service name that breaks out of the generated filter string and executes a PowerShell expression with the permissions of the Node.js process.

Defensive priority

Defenders should prioritize verifying the system's exposure to this vulnerability, especially in environments using the affected package version, and assess the feasibility of upgrading to a patched version or applying compensating controls.

Recommended defensive actions

• Verify if the systeminformation package version 5.33.15 is in use and prioritize upgrading to version 5.33.16 or later.
• Assess the exposure of systems using the affected package version and consider applying compensating controls if an upgrade is not feasible.
• Monitor system logs for suspicious PowerShell activity that may indicate exploitation attempts.
• Review system inventory to identify and prioritize assets that require patching or mitigation.
• Implement additional monitoring for systems with high risk or exposure.
• Conduct regular vulnerability scans to detect and address potential issues.
• Document and track remediation efforts for auditing and compliance purposes.

Evidence notes

The vulnerability is confirmed in version 5.33.15 of the systeminformation package. Other package versions have not been checked. The issue involves the services() function in lib/processes.js, which sanitizes input with sanitizeShellString() but fails to remove certain Unicode characters, allowing for command injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.