The vulnerable library, systeminformation for Node.js, unsanitizes the output of the OS locate command in its versions() function. This omission allows an attacker who can influence the output of locate or its environment to inject and execute arbitrary shell commands. The consequence is a full compromise of confidentiality, integrity, and availability on the affected system, allowing attackers to run any code with the privileges of the Node.js process.

All installations of the systeminformation package with a version older than 5.31.0, which is the version that contains the fix. The vulnerability applies to any Node.js application that imports and calls systeminformation. Versions protected by the update are not vulnerable.

The CVSS score of 8.8 indicates a high severity level, while the EPSS score of less than 1% shows a low current probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to be able to execute code in the context of the Node.js application or influence the locate command's output; it is inferred that exploitation is feasible in environments where the application runs with elevated privileges or where input to locate can be controlled.