systeminformation CVE-2026-116576 (GHSA-3f7j-7jwc-fxfj): Windows PowerShell command injection in si.services() via Unicode curly quotes. Which version fixes it?

What it is: systeminformation is a widely used npm package for reading OS, hardware and process details (often pulled in by monitoring dashboards, Electron apps and CLIs). On Windows, services() builds a PowerShell command from the service names you pass in. Its sanitizer removed normal ASCII quotes but not Unicode curly quotes, which PowerShell also treats as string delimiters, so a crafted service name could break out of the command and run PowerShell as the Node.js process's user. Published October 28, 2026 (high); fixed in 5.33.16. This package has had several similar injection fixes before, so staying current matters. Am I affected: - systeminformation below 5.33.16 (npm ls systeminformation; it is often transitive). - Only on Windows, and only if a value that someone else can influence (an API parameter, a config field, a dashboard input) reaches si.services(). Hard-coded service names in your own code are not an injection path. Fix: 1. Upgrade to systeminformation 5.33.16 or later (npm install systeminformation@latest, or an overrides/resolutions entry if a parent package pins it), rebuild and redeploy. 2. Until then, never pass user-controlled strings to si.services(); check names against an allow-list of expected service names (for example letters, digits, '-', '_' and '.') before calling it. 3. Run monitoring agents and dashboards with the least privileges they need, not as Administrator or SYSTEM. Verify: npm ls systeminformation shows 5.33.16+ everywhere in the deployed tree. Sources: https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-3f7j-7jwc-fxfj https://nvd.nist.gov/vuln/detail/CVE-2026-116576 https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.16