CVE-2025-68154

systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.

• CWE-78

• https://github.com/sebhildebrandt/systeminformation/commit/c52f9fd07fef42d2d8e8c66f75b42178da701c68Patch
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-wphj-fx3q-84chExploit, Mitigation, Vendor Advisory

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68148FreshRSS is a free, self-hostable RSS aggregator. From versi…7.5
• CVE-2025-6815The LatePoint – Calendar Booking Plugin for Appointments and…5.5
• CVE-2025-68150Parse Server is an open source backend that can be deployed …6.5
• CVE-2025-68151CoreDNS is a DNS server that chains plugins. Prior to versio…7.5
• CVE-2025-68152Juju is an open source application orchestration engine that…4.9
• CVE-2025-68153Juju is an open source application orchestration engine that…6.5
• CVE-2025-68155@vitejs/plugin-rs provides React Server Components (RSC) sup…7.5
• CVE-2025-68156Expr is an expression language and expression evaluation for…7.5
• CVE-2025-68157Webpack is a module bundler. From version 5.49.0 to before 5…3.7
• CVE-2025-68158Authlib is a Python library which builds OAuth and OpenID Co…8.8
• CVE-2025-6816A vulnerability classified as problematic was found in HDF5 …3.3
• CVE-2025-68160Issue summary: Writing large, newline-free data into a BIO c…4.7