Listen to this Post
The vulnerability CVE-2025-68154 exists in the `fsSize()` function of the systeminformation npm package for Node.js, specifically affecting Windows platforms . The function includes an optional parameter named `drive` which, if unsanitized and passed user-controlled input, is directly concatenated into a PowerShell command string . This lack of input sanitization allows an attacker to inject arbitrary PowerShell commands by including shell metacharacters such as semicolons or ampersands in the drive parameter . When the vulnerable `fsSize()` function is called with a maliciously crafted drive string, the entire concatenated command is executed by the Windows shell (cmd.exe or PowerShell) with the privileges of the Node.js process . This command injection can lead to full system compromise, including data exfiltration, malware installation, or lateral movement within a network . The issue is resolved by updating to version 5.27.14 or later, which includes proper sanitization of the input . The vulnerability is rated high severity due to the potential for remote code execution if an application passes external input to this function .
DailyCVE Form:
Platform: Windows
Version: <5.27.14
Vulnerability: Command Injection
Severity: High (8.1)
Date: 2025-12-16
Prediction: Patched (5.27.14+)
What Undercode Say:
Analytics
The vulnerability is a classic case of OS command injection (CWE-78) where untrusted data is concatenated into a system command. The `fsSize()` function on Windows constructs a PowerShell command using the user-supplied `drive` parameter without validation . For example, the vulnerable code pattern would resemble:
// Vulnerable code pattern (illustrative)
exec('powershell "Get-WmiObject Win32_LogicalDisk -Filter \"DeviceID=\'' + drive + '\'\""', callback);
An attacker could set the `drive` parameter to a value like `C:\”; calc.exe; \”` to terminate the intended command and execute arbitrary code. The exploitability depends entirely on whether an application passes unsanitized user input (from forms, APIs, or CLI arguments) to this function .
Exploit:
To exploit this, an attacker needs to identify an application that calls `si.fsSize()` with a user-controlled `drive` argument. The following Node.js code snippet demonstrates a proof-of-concept:
const si = require('systeminformation');
// Malicious drive parameter designed to break out and run a command
si.fsSize('C:\"; calc.exe; \"', function(data) {
console.log(data);
});
When executed on a vulnerable version (<5.27.14) on Windows, this would trigger the PowerShell command injection, launching the calculator application as a demonstration of code execution . In a real-world scenario, this could be replaced with a more malicious payload, such as a reverse shell or ransomware downloader.
Protection from this CVE
The primary protection is to update the `systeminformation` library to version 5.27.14 or higher in all Node.js projects . This can be done by running:
npm install systeminformation@latest
After updating, verify the version in your `package.json` and ensure no dependencies are forcing an older version by checking `npm ls systeminformation` . As a defense-in-depth measure, developers should never pass unsanitized user input to functions that execute system commands. Implement strict input validation using a whitelist of allowed drive letters (e.g., /^[A-Za-z]:\\$/). Additionally, run Node.js processes with the least privilege necessary to limit the impact of a successful exploit .
Impact
Successful exploitation allows an attacker to execute arbitrary operating system commands on the underlying Windows server or workstation . The impact is severe: an attacker could gain complete control over the application’s server, leading to data breaches (exfiltration of databases, environment variables with secrets), installation of backdoors or ransomware, and using the compromised host as a pivot point to attack other systems within the internal network . Given the library’s popularity (~5 million weekly downloads), a vulnerable application in a shared hosting environment, CI/CD pipeline, or exposed API endpoint could have widespread consequences .
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
