CVE-2020-26245: 
JavaScript vulnerability analysis and mitigation

The npm package systeminformation before version 4.30.5 was identified with a vulnerability that combines Prototype Pollution leading to Command Injection. The vulnerability was discovered and disclosed in November 2020, affecting all versions of the systeminformation package prior to version 4.30.5. The issue was addressed through a comprehensive rewrite of shell sanitations to prevent prototype pollution problems (GitHub Advisory, CVE Mitre).

The vulnerability received a CVSS v3.1 score of 8.8 (HIGH) and a CVSS v2.0 score of 7.5 (HIGH), indicating its significant severity. The core issue involved prototype pollution that could lead to command injection, particularly affecting the si.inetChecksite() function (NVD).

The vulnerability could potentially allow attackers to execute arbitrary commands through prototype pollution, posing a significant security risk to applications using the affected versions of systeminformation (GitHub Advisory).

The vulnerability specifically affects the service parameter strings passed to si.inetChecksite() function, which could be exploited through prototype pollution to achieve command injection (GitHub Advisory).

The vulnerability was patched in version 4.30.5 through a rewrite of shell sanitations. For users unable to upgrade, it is recommended to carefully check and sanitize service parameter strings that are passed to si.inetChecksite() (GitHub Advisory).