[GHSA-5vv4-hvf7-2h46] Command Injection via Unsanitized locate Output in versions() — systeminformation

[nikpivkin]

Updates

• Affected products

Comments
The range should be < 5.31.0, not <= 5.30.7.

The fix sebhildebrandt/systeminformation@b67d371 is in tag v5.31.0 and not in tag v5.30.8. The npm package of 5.30.8 still has the vulnerable exec(postgresqlBin[postgresqlBin.length - 1] + ' -V', ...) call in lib/osinfo.js. 5.30.7 is the version named as tested in the advisory, but it is not the last affected one.

So version 5.30.8 is still vulnerable but is outside the current range.

[github]

Hi there @sebhildebrandt! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot review overview

🟢 Approval recommended

The resulting range correctly includes vulnerable version 5.30.8 and excludes fixed version 5.31.0.

Review effort: Balanced
Findings: None

What changed in this PR

Corrects the affected range for systeminformation by relying on the existing 5.31.0 fixed-version event.

Changes:

• Removes the stale <= 5.30.7 affected-version metadata.

File	Description
GHSA-5vv4-hvf7-2h46.json	Corrects affected-version metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sebhildebrandt]

@nikpivkin @github this is correct the patched version is 5.31.0
so the (affected) range should be <= 5.30.8. or < 5.31.0