Vulnerability · Published Dec 16, 2025 · Assigned by GitHub_M
CVE-2025-68154Command Injection in fsSize() on Windows
High 8.1
In plain English
A high-severity OS command injection in systeminformation from sebhildebrandt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.0% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | jupyterlab | no fix listed | DEBIAN-CVE-2025-68154 |
| Debian:14 | jupyterlab | 4.0.11+ds5+~cs11.25.27-1 | DEBIAN-CVE-2025-68154 |
| Ubuntu:25.10 | jupyterlab | no fix listed | UBUNTU-CVE-2025-68154 |
| Ubuntu:26.04:LTS | jupyterlab | no fix listed | UBUNTU-CVE-2025-68154 |
| Ubuntu:26.10 | jupyterlab | no fix listed | UBUNTU-CVE-2025-68154 |
| Ubuntu:26.10 | node-systeminformation | no fix listed | UBUNTU-CVE-2025-68154 |
| npm | systeminformation | 5.27.14 | GHSA-wphj-fx3q-84ch |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sebhildebrandt | systeminformation | < 5.27.14 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H