CVE-2026-116576: CVE-2026-116576: OS Command Injection via Unicode Quotation Marks in Node.js systeminformation

A high-severity OS command injection flaw, CVE-2026-116576 (CVSS 7.8), affects the Node.js systeminformation library before version 5.33.16 on Windows. The sanitizeShellString() function strips ASCII quotation marks but allows Unicode typographic quotes (U+2018–U+201E), which PowerShell treats as string delimiters, letting attacker-controlled service names passed to services() or getDynamicData() break out of a Get-CimInstance filter and run arbitrary commands in the Node.js process context. The issue is fixed in 5.33.16, which adds strict character allowlisting and Unicode quote stripping, and a proof-of-concept exploit exists.

CVE-2026-116576: OS Command Injection via Unicode Quotation Marks in Node.js systeminformation Vulnerability ID: CVE-2026-116576 CVSS Score: 7.8 Published: 2026-10-28 CVE-2026-116576 GHSA-3f7j-7jwc-fxfj is an OS Command Injection vulnerability CWE-78 in the Node.js systeminformation library prior to version 5.33.16 on Microsoft Windows. The services API function dynamically constructs a PowerShell Get-CimInstance command using caller-supplied service names passed through sanitizeShellString . While the sanitizer strips standard ASCII quotation marks, it permits Unicode typographic quotation marks U+2018 through U+201E . Because the Windows PowerShell tokenizer recognizes Unicode quotation marks as valid string literal delimiters, an attacker who controls the service name input can break out of the CIM filter string and execute arbitrary PowerShell commands within the security context of the Node.js process. TL;DR Prior to version 5.33.16, the systeminformation Node.js package fails to strip Unicode typographic quotation marks in sanitizeShellString on Windows. Attackers who can pass input to services or getDynamicData can use Unicode quotes to break out of a PowerShell Get-CimInstance filter string and execute arbitrary OS commands. ⚠️ Exploit Status: POC Technical Details - Vulnerability Type : OS Command Injection CWE-78 - Affected Component : systeminformation services in lib/processes.js & sanitizeShellString in lib/util.js - Target Platform : Microsoft Windows Node.js runtime - CVSS v3.1 Score : 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS Score : 0.145% 3.76th Percentile - Root Cause : Incomplete quote sanitization allowing Unicode smart quotes U+2018-U+201E to break out of PowerShell Get-CimInstance filter strings - Patched Version : 5.33.16 - CISA KEV Status : Not Listed Affected Systems - systeminformation npm package < 5.33.16 on Microsoft Windows - systeminformation : < 5.33.16 Fixed in: 5.33.16 Code Analysis utils sanitizeShellString extended windows Mitigation Strategies - Upgrade systeminformation to version 5.33.16 or later to apply strict character allowlisting in services and Unicode quote stripping in sanitizeShellString . - Enforce strict allowlist validation e.g., /^ a-zA-Z0-9 .-@ +$/ on all user-supplied service names prior to invoking systeminformation.services or systeminformation.getDynamicData . - Run Node.js applications under least-privilege Windows service accounts rather than Administrator or NT AUTHORITY\SYSTEM. - Monitor child process execution of powershell.exe spawned by node.exe and enable PowerShell Script Block Logging Event ID 4104 to detect command injection attempts. Remediation Steps: 1. Audit package.json and package-lock.json or yarn.lock / pnpm-lock.yaml for systeminformation versions prior to 5.33.16. 2. Run 'npm install systeminformation@^5.33.16' to update the dependency to the patched release. 3. Review application code paths that pass HTTP query parameters, request bodies, or IPC arguments to si.services or si.getDynamicData and implement strict input allowlisting. 4. Redeploy the updated application and verify via dependency scanning that no transitive dependencies resolve to systeminformation < 5.33.16. References Read the full report for CVE-2026-116576 on our website https://cvereports.com/reports/CVE-2026-116576 for more details including interactive diagrams and full exploit analysis.