Security1 hOctober 29, 2026, 10:30

systeminformation flaw allows command injection via Unicode quotes

Node.js library systeminformation before 5.33.16 on Windows is affected by CVE-2026-116576 (CVSS 7.8). Its services() function fails to strip Unicode typographic quotes U+2018–U+201E, which PowerShell treats as string delimiters, enabling arbitrary command execution. The fix ships in version 5.33.16.

DEV Community

Open source

systeminformation flaw allows command injection via Unicode quotes

CVE-2026-116576 carries a CVSS score of 7.8
Affects systeminformation < 5.33.16 on Windows
Exploit uses Unicode quotes U+2018–U+201E in services()
Fixed in 5.33.16 with strict character allowlisting

#Node.js#PowerShell#Systeminformation

Microsoft releases Windows Developer Config to set up Windows 11 with one command

Security

CVE-2026-106931 in SiteGuard: command injection already exploited

Security

CVE-2026-77931 in MoviePilot: prompt injection leads to command execution

Security

systeminformation flaw allows command injection via Unicode quotes

Microsoft releases Windows Developer Config to set up Windows 11 with one command

CVE-2026-106931 in SiteGuard: command injection already exploited

CVE-2026-77931 in MoviePilot: prompt injection leads to command execution

CVE-2026-0313: OS command injection in OS Query for Cortex XSOAR and XSIAM