Node.js Alert: systeminformation Flaw Risks Windows RCE for 16M+ Monthly Users

A high-severity vulnerability has been uncovered in systeminformation, a Node.js library used to retrieve system metrics, tracked as CVE-2025-68154. The flaw exposes Windows-based applications to OS command injection, potentially allowing attackers to execute arbitrary code and seize control of affected servers, with the library reportedly having over 16m downloads per month.

The vulnerability lies in the library’s fsSize() function on Windows, where a lack of input sanitisation turns it into an open door for attackers; according to the security advisory, “The optional drive parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function.”

Exploitation could lead to Remote Code Execution, with attack scenarios including total compromise, data theft, lateral movement and even ransomware deployment. The vulnerability affects systeminformation versions 5.27.13 and below on Windows, while Linux, macOS and other Unix-based systems are unaffected; developers are urged to upgrade to version 5.27.14 immediately to neutralise the threat.