CVE-2026-116576
Description
A flaw was found in systeminformation. On Windows systems, the library's input sanitization removes standard quotation marks but fails to filter Unicode quotation marks when constructing PowerShell commands. An attacker who can supply input to an application using this library can exploit this flaw to break out of the intended command context and execute arbitrary commands with the privileges of the running Node.js process. This can lead to unauthorized data access, system modification, or service disruption.
Statement
This vulnerability is evaluated as having an Important impact for Red Hat products because improper input sanitization could permit arbitrary command execution under the privileges of the application process. However, the affected code path specifically relies on PowerShell invocations utilized during Windows system inspection, which are not executed on Red Hat enterprise Linux environments. Furthermore, the underlying component does not listen on network interfaces by default, requiring an integrating service to explicitly forward untrusted parameters into the query function to trigger the flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to avoid shell invocation or enforce strict character allowlists before passing service names to PowerShell within systeminformation: upgrade to systeminformation 5.33.16 (or the corresponding fixed Red Hat builds), which remove Unicode quotation marks and dashes in sanitizeShellString() and enforce an allowed character whitelist for service names on Windows, closing all 2 injection vectors (crafted service names with Unicode quotation marks, PowerShell filter string termination). Until patched, this is only a concern on Windows systems hosting Node.js applications that forward untrusted input to services() or getDynamicData() — Red Hat Enterprise Linux environments, Linux, and macOS deployments are unaffected — so Audit and restrict application entry points to prevent untrusted input from reaching services() or getDynamicData(), or reject inputs containing non-ASCII characters and quotes. As a compensating measure, Sanitize downstream PowerShell argument and filter delimiters in user input prior to CLI command execution, Enforce Windows Defender Application Control in enforced mode with PowerShell Constrained Language Mode to block unauthorized binaries and commands an injected expression might run, and Deploy EDR agents to detect anomalous child process execution and suspicious PowerShell activity spawned by the Node.js process. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper quotation mark sanitization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
