{
  "@id": "urn:uuid:ff97f0f8-8fdf-4476-b1a0-e21188ef55e9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T15:51:34.970346+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:33.672370+00:00",
      "status_notes": "Vulnerability CVE-2020-26245 does not affect version 5.23.8 of systeminformation. not_affected \u2014 CVE-2020-26245 describes a command injection vulnerability via prototype pollution in the inetChecksite() function. The vulnerability was fixed in upstream version 4.30.2 (commit 73dce8d7, November 25, 2020) by rewriting shell sanitization to use character-by-character iteration instead of .replace() methods (which can be polluted) and adding isPrototypePolluted() detection. The target version ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26245"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-26245 describes a command injection vulnerability via prototype pollution in the inetChecksite() function. The vulnerability was fixed in upstream version 4.30.2 (commit 73dce8d7, November 25, 2020) by rewriting shell sanitization to use character-by-character iteration instead of .replace() methods (which can be polluted) and adding isPrototypePolluted() detection. The target version ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T13:43:26.013143+00:00",
      "status_notes": "Vulnerability CVE-2020-26274 does not affect version 5.23.8 of systeminformation. not_affected \u2014 The target repository (systeminformation v5.23.8-tuxcare.3) is NOT AFFECTED by CVE-2020-26274. The command injection vulnerability in the inetLatency() function was fixed in upstream version 4.31.1 (commit 1faadcbf, 2020-12-11) by adding sanitization for single quotes and backticks. The current target version (5.23.8) is significantly newer than the fixed version (4.31.1) and contains the compl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26274"
      },
      "impact_statement": "not_affected \u2014 The target repository (systeminformation v5.23.8-tuxcare.3) is NOT AFFECTED by CVE-2020-26274. The command injection vulnerability in the inetLatency() function was fixed in upstream version 4.31.1 (commit 1faadcbf, 2020-12-11) by adding sanitization for single quotes and backticks. The current target version (5.23.8) is significantly newer than the fixed version (4.31.1) and contains the compl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:04.560309+00:00",
      "status_notes": "Vulnerability CVE-2020-26300 does not affect version 5.23.8 of systeminformation. not_affected \u2014 CVE-2020-26300 command injection vulnerability is NOT present in systeminformation 5.23.8-tuxcare.3. The upstream vendor (Sebastian Hildebrandt) fixed this vulnerability between October 2020 and February 2021 in commits 931fecae (inetChecksite), 1faadcbf (inetLatency), and 07daa05f (processLoad, services). All five affected functions now sanitize user input via sanitizeShellString() before pass...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26300"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-26300 command injection vulnerability is NOT present in systeminformation 5.23.8-tuxcare.3. The upstream vendor (Sebastian Hildebrandt) fixed this vulnerability between October 2020 and February 2021 in commits 931fecae (inetChecksite), 1faadcbf (inetLatency), and 07daa05f (processLoad, services). All five affected functions now sanitize user input via sanitizeShellString() before pass..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:39.156684+00:00",
      "status_notes": "Vulnerability CVE-2020-7752 does not affect version 5.23.8 of systeminformation. not_affected \u2014 CVE-2020-7752 (command injection in inetChecksite) was already fixed in upstream version 5.23.8 before TuxCare onboarded it. The vulnerable pattern (string concatenation of user input into shell commands) was replaced with safe argument arrays passed to spawn() in commit 7922366d on March 15, 2021. The target version 5.23.8-tuxcare.3 inherited this fix from the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7752"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-7752 (command injection in inetChecksite) was already fixed in upstream version 5.23.8 before TuxCare onboarded it. The vulnerable pattern (string concatenation of user input into shell commands) was replaced with safe argument arrays passed to spawn() in commit 7922366d on March 15, 2021. The target version 5.23.8-tuxcare.3 inherited this fix from the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T13:46:23.146908+00:00",
      "status_notes": "Vulnerability CVE-2020-7778 does not affect version 5.23.8 of systeminformation. not_affected \u2014 CVE-2020-7778 is a prototype pollution vulnerability affecting systeminformation before version 4.30.2. The target version 5.23.8-tuxcare.3 is NOT vulnerable. The upstream vendor (Sebastian Hildebrandt) fixed this issue in commit 73dce8d7 (Nov 25, 2020) by adding the isPrototypePolluted() detection function and applying protective checks before all command execution paths. This fix was already ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7778"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-7778 is a prototype pollution vulnerability affecting systeminformation before version 4.30.2. The target version 5.23.8-tuxcare.3 is NOT vulnerable. The upstream vendor (Sebastian Hildebrandt) fixed this issue in commit 73dce8d7 (Nov 25, 2020) by adding the isPrototypePolluted() detection function and applying protective checks before all command execution paths. This fix was already ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T13:50:27.486705+00:00",
      "status_notes": "Vulnerability CVE-2021-21315 does not affect version 5.23.8 of systeminformation. not_affected \u2014 CVE-2021-21315 is NOT present in systeminformation 5.23.8-tuxcare.3. The command injection vulnerability was fixed by upstream vendor in version 5.3.1 (released 2021-02-14) with type validation checks that reject array inputs. All four vulnerable functions (inetChecksite, inetLatency, services, processLoad) now validate that their parameters are strings before processing, preventing the array-b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21315"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21315 is NOT present in systeminformation 5.23.8-tuxcare.3. The command injection vulnerability was fixed by upstream vendor in version 5.3.1 (released 2021-02-14) with type validation checks that reject array inputs. All four vulnerable functions (inetChecksite, inetLatency, services, processLoad) now validate that their parameters are strings before processing, preventing the array-b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T13:44:14.640121+00:00",
      "status_notes": "Vulnerability CVE-2021-21388 does not affect version 5.23.8 of systeminformation. not_affected \u2014 CVE-2021-21388 command injection vulnerability is NOT present in systeminformation v5.23.8-tuxcare.3. The vulnerability allowed attackers to bypass string sanitization by passing arrays instead of strings to functions like inetLatency(), inetChecksite(), services(), and processLoad(). All four functions now have type checking (typeof !== 'string') that rejects non-string parameters, preventing ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21388"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21388 command injection vulnerability is NOT present in systeminformation v5.23.8-tuxcare.3. The vulnerability allowed attackers to bypass string sanitization by passing arrays instead of strings to functions like inetLatency(), inetChecksite(), services(), and processLoad(). All four functions now have type checking (typeof !== 'string') that rejects non-string parameters, preventing ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T13:52:02.256694+00:00",
      "status_notes": "Vulnerability CVE-2023-42810 does not affect version 5.23.8 of systeminformation. not_affected \u2014 CVE-2023-42810 SSID Command Injection vulnerability is NOT present in systeminformation 5.23.8. The upstream vendor (Sebastian Hildebrandt) fixed this vulnerability in version 5.21.7 (commit 797256581, 2023-09-19) by adding comprehensive input sanitization to wifiConnections() and wifiNetworks() functions. Both functions now use util.sanitizeString() with strict mode to filter shell metacharact...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42810"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42810 SSID Command Injection vulnerability is NOT present in systeminformation 5.23.8. The upstream vendor (Sebastian Hildebrandt) fixed this vulnerability in version 5.21.7 (commit 797256581, 2023-09-19) by adding comprehensive input sanitization to wifiConnections() and wifiNetworks() functions. Both functions now use util.sanitizeString() with strict mode to filter shell metacharact..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2024-56334 affects version 5.23.8 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2024-56334"
      },
      "action_statement": "Vulnerability CVE-2024-56334 affects version 5.23.8 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-68154 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-68154"
      },
      "action_statement": "Vulnerability CVE-2025-68154 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T15:51:34.970346+00:00",
      "status_notes": "Vulnerability CVE-2026-116576 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-116576"
      },
      "action_statement": "Vulnerability CVE-2026-116576 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T10:29:00.052910+00:00",
      "status_notes": "Vulnerability CVE-2026-116673 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-116673"
      },
      "action_statement": "Vulnerability CVE-2026-116673 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-11-03T10:29:00.052910+00:00",
      "status_notes": "Vulnerability CVE-2026-116674 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-116674"
      },
      "action_statement": "Vulnerability CVE-2026-116674 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-26280 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-26280"
      },
      "action_statement": "Vulnerability CVE-2026-26280 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-26318 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-26318"
      },
      "action_statement": "Vulnerability CVE-2026-26318 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44724 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44724"
      },
      "action_statement": "Vulnerability CVE-2026-44724 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.23.8",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.23.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50289 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-50289"
      },
      "action_statement": "Vulnerability CVE-2026-50289 affects version 5.23.8 of systeminformation, and is fixed in 5.23.8-tuxcare.1."
    }
  ]
}