CVE-2025-68154 Overview
CVE-2025-68154 is a command injection vulnerability affecting the systeminformation library for Node.js. The fsSize() function in versions prior to 5.27.14 is vulnerable to OS command injection on Windows systems. The optional drive parameter is directly concatenated into a PowerShell command without proper sanitization, allowing arbitrary command execution when user-controlled input reaches this function.
Critical Impact
Attackers who can control input to the fsSize() function can execute arbitrary commands on Windows systems, potentially leading to complete system compromise, data exfiltration, or malware deployment.
Affected Products
- systeminformation versions prior to 5.27.14
- Microsoft Windows (as the target operating system)
- Node.js applications using the vulnerable fsSize() function with user-controlled input
Discovery Timeline
- 2025-12-16 - CVE-2025-68154 published to NVD
- 2025-12-16 - systeminformation releases security patch version 5.27.14
- 2026-02-19 - Last updated in NVD database
Technical Details for CVE-2025-68154
Vulnerability Analysis
The vulnerability resides in the fsSize() function of the systeminformation Node.js library. This function is designed to retrieve file system size information, and on Windows systems, it accomplishes this by executing PowerShell commands. The issue arises from the direct concatenation of the optional drive parameter into the PowerShell command string without proper input sanitization.
When an application passes user-controlled input to the drive parameter, an attacker can inject arbitrary PowerShell commands that will execute with the privileges of the Node.js process. The actual exploitability depends on how applications use this function—if an application does not pass user-controlled input to fsSize(), it is not vulnerable.
Root Cause
The root cause is improper input validation (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The drive parameter was not sanitized before being concatenated into a PowerShell command, allowing shell metacharacters and additional commands to be injected. This is a classic example of trusting user input in command construction without proper escaping or validation.
Attack Vector
The attack vector is network-based, requiring an attacker to influence the input passed to the fsSize() function. This typically occurs in web applications or APIs that accept drive path information from users and pass it to the systeminformation library. An attacker would craft a malicious drive parameter containing PowerShell command injection payloads.
The following code examples show the security patch applied in version 5.27.14:
</tr>
</thead>
<tbody>
+ <tr>
+ <th scope="row">5.27.14</th>
+ <td>2025-12-16</td>
+ <td><span class="code">fsSize()</span> fix sanitation drive (windows)</td>
+ </tr>
<tr>
<th scope="row">5.27.13</th>
<td>2025-12-10</td>
Source: GitHub Commit Update
The vendor also updated their security advisory to recommend updating to version 5.27.14:
<body>
<header class="bg-image-full">
<div class="top-container">
- <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.23.7</a>
+ <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.27.14</a>
<img class="logo" src="assets/logo.png" alt="logo">
<div class="title">systeminformation</div>
<div class="subtitle"><span id="typed"></span> </div>
- <div class="version">New Version: <span id="version">5.27.13</span></div>
+ <div class="version">New Version: <span id="version">5.27.14</span></div>
<button class="btn btn-light" onclick="location.href='https://github.com/sebhildebrandt/systeminformation'">View on Github <i class=" fab fa-github"></i></button>
</div>
<div class="down">
Source: GitHub Commit Update
Detection Methods for CVE-2025-68154
Indicators of Compromise
- Unexpected PowerShell process spawning from Node.js applications
- Unusual command execution patterns in Windows event logs associated with Node.js processes
- Anomalous network connections or file system access initiated by systeminformation-dependent applications
- Suspicious input patterns in application logs containing shell metacharacters (;, |, &, `) in drive path parameters
Detection Strategies
- Monitor PowerShell execution logs for commands spawned by Node.js processes with unusual parameters or chained commands
- Implement application-level logging to track all inputs passed to the fsSize() function
- Use endpoint detection and response (EDR) solutions to detect command injection patterns and unexpected child process creation from Node.js applications
- Scan application dependencies using software composition analysis (SCA) tools to identify vulnerable systeminformation versions
Monitoring Recommendations
- Enable Windows Script Block Logging and Module Logging for PowerShell to capture executed commands
- Configure SentinelOne to alert on suspicious command injection patterns originating from Node.js processes
- Implement real-time monitoring of process creation events for PowerShell spawned by Node.js applications on Windows systems
- Review application logs regularly for malformed or suspicious drive path inputs
How to Mitigate CVE-2025-68154
Immediate Actions Required
- Update systeminformation to version 5.27.14 or later immediately
- Audit your application code to identify any usage of fsSize() with user-controlled input
- Implement input validation for drive parameters before passing them to fsSize() as an additional defense layer
- Consider restricting the allowed characters in drive path inputs to alphanumeric characters and standard path delimiters only
Patch Information
The vulnerability has been addressed in systeminformation version 5.27.14, released on 2025-12-16. The patch implements proper sanitation of the drive parameter on Windows systems before it is used in PowerShell command construction.
For detailed patch information, see the GitHub Security Advisory (GHSA-wphj-fx3q-84ch) and the security patch commit.
Workarounds
- If immediate upgrade is not possible, avoid passing user-controlled input to the fsSize() function
- Implement strict input validation that rejects any input containing shell metacharacters before calling fsSize()
- Consider using a hardcoded list of allowed drive letters rather than accepting dynamic input
# Update systeminformation to patched version
npm update systeminformation@5.27.14
# Verify installed version
npm list systeminformation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
