OS command injection in systeminformation - CVE-2025-68154
Published: December 18, 2025
Vulnerability identifier: #VU120201
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2025-68154
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Sebastian Hildebrandt
Affected software:
systeminformation
systeminformation
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the fsSize() function when parsing an optional "drive" parameter in lib/filesystem.js. A remote attacker can pass specially crafted input to the application and execute arbitrary OS commands on the target system.
The vulnerability affects Windows installations only.
How to mitigate CVE-2025-68154
Install updates from vendor's website.