CVE-2020-26300

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-2630110.0ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerabCVE-2020-263027.5is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular ExCVE-2020-263037.5insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to RegulCVE-2020-263047.5Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular ExpressCVE-2020-263057.5CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to ReCVE-2020-263068.7Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and priorCVE-2020-263078.7HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expresCVE-2020-263087.5Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions tCVE-2020-263098.7Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions tCVE-2020-26316.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). SuppCVE-2020-263108.7Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expCVE-2020-263117.5Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulner
CVE-2020-26300: Critical severity, CVSS 9.8 | Vulnix