CVE-2020-26300

systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.

• CWE-77
• CWE-78

• https://github.com/advisories/GHSA-fj59-f6c3-3vw4Patch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/commit/bad372e654cdd549e7d786acbba0035ded54c607Patch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-fj59-f6c3-3vw4Third Party Advisory
• https://www.npmjs.com/package/systeminformationProduct, Third Party Advisory
• https://github.com/advisories/GHSA-fj59-f6c3-3vw4Patch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/commit/bad372e654cdd549e7d786acbba0035ded54c607Patch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-fj59-f6c3-3vw4Third Party Advisory
• https://www.npmjs.com/package/systeminformationProduct, Third Party Advisory

Published

Sep 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26295OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26296Vega is a visualization grammar, a declarative format for cr…8.7
• CVE-2020-26297mdBook is a utility to create modern online books from Markd…6.1
• CVE-2020-26298Redcarpet is a Ruby library for Markdown processing. In Redc…5.4
• CVE-2020-26299ftp-srv is an open-source FTP server designed to be simple y…9.6
• CVE-2020-2630Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26301ssh2 is client and server modules written in pure JavaScript…10
• CVE-2020-26302is.js is a general-purpose check library. Versions 0.9.0 and…7.5
• CVE-2020-26303insane is a whitelist-oriented HTML sanitizer. Versions 2.6.…7.5
• CVE-2020-26304Foundation is a front-end framework. Versions 6.3.3 and prio…7.5
• CVE-2020-26305CommonRegexJS is a CommonRegex port for JavaScript. All avai…7.5
• CVE-2020-26306Knwl.js is a Javascript library that parses through text for…8.7