Critical Vulnerability in Popular Node.js Library Exposes Windows Systems to RCE Attacks

A critical OS command injection vulnerability (CVE-2025-68154) was disclosed in the widely used Node.js package systeminformation: versions up to 5.27.13 allow attacker-controlled input passed to fsSize() to be injected into a PowerShell command on Windows, enabling arbitrary command execution. The advisory reports a CVSS score of 7.5, notes the flaw affects applications that pass user input directly to fsSize() (e.g., web apps, APIs, dashboards), and instructs developers to upgrade immediately to version 5.27.14 which properly validates input.