Summary
A command injection vulnerability in the systeminformation Node.js library allows crafted service names to alter a PowerShell filter executed by the Windows implementation of services().
If attacker-controlled input reaches services() or getDynamicData(), the injected expression may run with the permissions of the Node.js process.
A command injection vulnerability in the systeminformation Node.js library allows crafted service names to alter a PowerShell filter executed by the Windows implementation of services().
If attacker-controlled input reaches services() or getDynamicData(), the injected expression may run with the permissions of the Node.js process.
Affected context
The issue affects Windows deployments using systeminformation versions before the security fix where services() processes caller-supplied service names. Risk is highest when a consuming application forwards untrusted input to services() or getDynamicData(), because the package itself does not expose a network service. The vulnerable command construction occurs when the input is incorporated into a PowerShell Get-CimInstance filter.
The issue affects Windows deployments using systeminformation versions before the security fix where services() processes caller-supplied service names. Risk is highest when a consuming application forwards untrusted input to services() or getDynamicData(), because the package itself does not expose a network service. The vulnerable command construction occurs when the input is incorporated into a PowerShell Get-CimInstance filter.
Exploit preconditions
- Attack surface: The Windows services() implementation and its PowerShell execution path
- Required access: Ability to influence a service-name value passed by a consuming application
- Trigger point: Construction and execution of the PowerShell Get-CimInstance filter
- Why exploitation is possible: The sanitizer removes ASCII quotation marks but permits Unicode quotation marks that PowerShell recognizes as delimiters, allowing input to escape the intended filter context
- Attack surface: The Windows services() implementation and its PowerShell execution path
- Required access: Ability to influence a service-name value passed by a consuming application
- Trigger point: Construction and execution of the PowerShell Get-CimInstance filter
- Why exploitation is possible: The sanitizer removes ASCII quotation marks but permits Unicode quotation marks that PowerShell recognizes as delimiters, allowing input to escape the intended filter context
Why this happens
The vulnerability results from embedding caller-controlled data directly into a PowerShell command after applying incomplete, context-insensitive sanitization. Because accepted Unicode quotation marks can retain delimiter semantics in PowerShell, the input may change the structure of the generated expression rather than remain a literal service name. This is an instance of CWE-78: Improper Neutralization of Special Elements used in an OS Command, where untrusted data reaches an operating-system command interpreter without reliable separation from executable syntax.
The vulnerability results from embedding caller-controlled data directly into a PowerShell command after applying incomplete, context-insensitive sanitization. Because accepted Unicode quotation marks can retain delimiter semantics in PowerShell, the input may change the structure of the generated expression rather than remain a literal service name. This is an instance of CWE-78: Improper Neutralization of Special Elements used in an OS Command, where untrusted data reaches an operating-system command interpreter without reliable separation from executable syntax.
Potential impact
- An attacker may execute PowerShell expressions with the Node.js process account's permissions.
- Accessible files may be read, modified, or deleted.
- Application data may be altered or corrupted.
- The affected service or application may be disrupted.
- Additional compromise may be possible when the process has excessive privileges.
- An attacker may execute PowerShell expressions with the Node.js process account's permissions.
- Accessible files may be read, modified, or deleted.
- Application data may be altered or corrupted.
- The affected service or application may be disrupted.
- Additional compromise may be possible when the process has excessive privileges.
General mitigation guidance
Mitigation should focus on preventing untrusted values from becoming executable PowerShell syntax.
Common defensive patterns include:
- Use structured command or API interfaces that pass filter values as data rather than concatenating command strings.
- Prefer parameterized, typed, or allowlisted service-name handling over blacklist-based character removal.
- Apply validation appropriate to the expected service-name format before invoking system queries.
- Reduce input trust by ensuring consuming applications do not forward raw request values into system-information APIs.
- Run Node.js processes with the least privileges and restrict their access to sensitive files and application resources.
- Treat Unicode normalization and shell-specific parsing behavior as part of input validation and testing.
Mitigation should focus on preventing untrusted values from becoming executable PowerShell syntax.
Common defensive patterns include:
- Use structured command or API interfaces that pass filter values as data rather than concatenating command strings.
- Prefer parameterized, typed, or allowlisted service-name handling over blacklist-based character removal.
- Apply validation appropriate to the expected service-name format before invoking system queries.
- Reduce input trust by ensuring consuming applications do not forward raw request values into system-information APIs.
- Run Node.js processes with the least privileges and restrict their access to sensitive files and application resources.
- Treat Unicode normalization and shell-specific parsing behavior as part of input validation and testing.
How teams detect issues like this
Detection can include static analysis for PowerShell command construction that concatenates or interpolates caller-controlled values, especially around Get-CimInstance and process-spawning helpers. Code review should examine sanitization routines for shell-context completeness, Unicode handling, and the absence of parameterized query mechanisms. Runtime monitoring can flag unexpected PowerShell child processes, unusual command-line patterns, or access to files outside the application's normal operating profile. Policy enforcement may require approved command-execution wrappers and prohibit dynamic shell expressions in application code. Automated code review and software composition analysis tools can help identify related command-injection patterns.
Detection can include static analysis for PowerShell command construction that concatenates or interpolates caller-controlled values, especially around Get-CimInstance and process-spawning helpers. Code review should examine sanitization routines for shell-context completeness, Unicode handling, and the absence of parameterized query mechanisms. Runtime monitoring can flag unexpected PowerShell child processes, unusual command-line patterns, or access to files outside the application's normal operating profile. Policy enforcement may require approved command-execution wrappers and prohibit dynamic shell expressions in application code. Automated code review and software composition analysis tools can help identify related command-injection patterns.
