Loading story…
A critical vulnerability has been identified in the systeminformation library for Node.js, specifically affecting Windows systems. The flaw, tracked as CVE-2025-68154, resides in the fsSize() function, which fails to properly sanitize the drive parameter before concatenating it into a PowerShell command. This oversight allows for OS command injection, enabling attackers to execute arbitrary commands on affected systems if user-controlled input is passed to the vulnerable function. The issue is particularly concerning given the library's widespread use, with over 16 million monthly users potentially at risk.
The vulnerability is remotely exploitable and has been addressed in version 5.27.14 of the library. Security researchers emphasize that the actual risk depends on how applications utilize the fsSize() function; if user input is not passed to this function, the risk is mitigated. Organizations using the systeminformation library on Windows are strongly advised to update to the patched version immediately to prevent exploitation and potential compromise of their systems.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent public reporting emphasized that the Windows RCE risk in the systeminformation package could affect more than 16 million monthly users of the library. The coverage framed the flaw as a significant risk for Node.js deployments using the package on Windows systems.
The vulnerability was patched in systeminformation version 5.27.14, with advisories and patch details made available on GitHub. Users were advised to upgrade to 5.27.14 or later and avoid passing unsanitized user input to fsSize().
A high-severity OS command injection vulnerability, tracked as CVE-2025-68154, was identified in the systeminformation Node.js library's fsSize() function on Windows. The issue stems from unsanitized concatenation of the optional drive parameter into a PowerShell command, enabling arbitrary command execution when applications pass user-controlled input.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed a critical 0-day vulnerability in Windows PowerShell, tracked as CVE-2025-54100, which allows attackers to execute arbitrary code on affected systems. The flaw arises from improper neutralization of special elements in PowerShell's command processing, enabling command injection if an attacker can trick a user into running a malicious script or command. Exploitation requires local access and user interaction, but successful attacks can result in privilege escalation and full system compromise, making this vulnerability a significant risk for organizations relying on PowerShell for administration and automation. No official patch is available yet, and Microsoft has urged organizations to apply immediate mitigations and monitor for updates. The vulnerability is rated as 'Important' with a CVSS score of 7.8, and its potential for chaining with other exploits increases its attractiveness to threat actors. Attack vectors include phishing, watering-hole attacks, and supply-chain compromises where PowerShell scripts are abused during software installation or updates. Security teams are advised to remain vigilant and implement recommended mitigations until a patch is released.
Jun 29, 2026
Microsoft published Security Update Guide entries for two Windows remote code execution vulnerabilities affecting different core components: **CVE-2022-41118** in **Windows Scripting Languages** and **CVE-2025-59295** in **Windows URL Parsing**. Both advisories classify the issues as remote code execution flaws, indicating that successful exploitation could allow an attacker to run arbitrary code on a targeted Windows system. The disclosures point to risk across widely used Windows functionality rather than a single application, underscoring the need for defenders to review affected product versions and apply Microsoft-issued updates through normal patch management channels. The vulnerabilities are tracked under the identifiers `CVE-2022-41118` and `CVE-2025-59295`, with Microsoft maintaining the authoritative remediation details in its Security Update Guide.
Jul 12, 2026
A public proof-of-concept exploit has been released for **CVE-2026-42980**, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain **`NT AUTHORITY\SYSTEM`** access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds. Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a **CVSS 3.1 score of `7.8`**, and assessed exploitation as **"more likely."** While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.
Jul 23, 2026