{
  "@id": "urn:uuid:a4803a1d-20b4-4e0e-bb10-b9a260590528",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:57:49.342266+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-26245 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26245"
      },
      "action_statement": "Vulnerability CVE-2020-26245 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2020-26274 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26274"
      },
      "action_statement": "Vulnerability CVE-2020-26274 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2020-26300 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26300"
      },
      "action_statement": "Vulnerability CVE-2020-26300 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-7752 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-7752"
      },
      "action_statement": "Vulnerability CVE-2020-7752 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-7778 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-7778"
      },
      "action_statement": "Vulnerability CVE-2020-7778 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:05:56.841018+00:00",
      "status_notes": "Vulnerability CVE-2021-21315 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2021-21315"
      },
      "action_statement": "Vulnerability CVE-2021-21315 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2021-21388 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2021-21388"
      },
      "action_statement": "Vulnerability CVE-2021-21388 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:07:18.587233+00:00",
      "status_notes": "Vulnerability CVE-2023-42810 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2023-42810"
      },
      "action_statement": "Vulnerability CVE-2023-42810 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2024-56334 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2024-56334"
      },
      "action_statement": "Vulnerability CVE-2024-56334 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-11-13T19:56:51.545945+00:00",
      "status_notes": "Vulnerability CVE-2025-68154 does not affect version 5.31.0 of systeminformation. not_affected \u2014 The target (systeminformation 5.31.0) already contains the upstream fix for CVE-2025-68154. In lib/filesystem.js fsSize(), the Windows branch sanitizes the drive argument with util.sanitizeShellString(drive, true) before building the PowerShell command. The fix is upstream commit c52f9fd0 by Sebastian Hildebrandt. It is in the 5.31.0 release and is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-68154"
      },
      "impact_statement": "not_affected \u2014 The target (systeminformation 5.31.0) already contains the upstream fix for CVE-2025-68154. In lib/filesystem.js fsSize(), the Windows branch sanitizes the drive argument with util.sanitizeShellString(drive, true) before building the PowerShell command. The fix is upstream commit c52f9fd0 by Sebastian Hildebrandt. It is in the 5.31.0 release and is not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T04:17:38.235616+00:00",
      "status_notes": "Vulnerability CVE-2026-116576 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116576"
      },
      "action_statement": "Vulnerability CVE-2026-116576 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T01:53:34.860114+00:00",
      "status_notes": "Vulnerability CVE-2026-116673 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116673"
      },
      "action_statement": "Vulnerability CVE-2026-116673 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-10-29T01:54:26.951601+00:00",
      "status_notes": "Vulnerability CVE-2026-116674 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116674"
      },
      "action_statement": "Vulnerability CVE-2026-116674 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:49.342266+00:00",
      "status_notes": "Vulnerability CVE-2026-26280 does not affect version 5.31.0 of systeminformation. not_affected \u2014 The wifiNetworks() retry-path command injection (CVE-2026-26280) is already fixed in this target. The retry setTimeout in lib/wifi.js calls getWifiNetworkListIw(ifaceSanitized), not the raw iface. The fix is upstream commit 22242aa5 by the upstream author, and it shipped in the 5.30.8 release that this 5.31.0 tree is built on.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-26280"
      },
      "impact_statement": "not_affected \u2014 The wifiNetworks() retry-path command injection (CVE-2026-26280) is already fixed in this target. The retry setTimeout in lib/wifi.js calls getWifiNetworkListIw(ifaceSanitized), not the raw iface. The fix is upstream commit 22242aa5 by the upstream author, and it shipped in the 5.30.8 release that this 5.31.0 tree is built on."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:00.034569+00:00",
      "status_notes": "Vulnerability CVE-2026-26318 does not affect version 5.31.0 of systeminformation. not_affected \u2014 CVE-2026-26318 (command injection via unsanitized `locate bin/postgres` output in versions() on Linux) is already fixed in this target. HEAD contains upstream commit b67d3715 by the upstream author. It filters locate results through a safe-path regex (lib/osinfo.js:772-777) and replaces the shell-based exec() with execFile(path, ['-V']) (line 779), so no shell parses the path. The fix shipped i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-26318"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-26318 (command injection via unsanitized `locate bin/postgres` output in versions() on Linux) is already fixed in this target. HEAD contains upstream commit b67d3715 by the upstream author. It filters locate results through a safe-path regex (lib/osinfo.js:772-777) and replaces the shell-based exec() with execFile(path, ['-V']) (line 779), so no shell parses the path. The fix shipped i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44724 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-44724"
      },
      "action_statement": "Vulnerability CVE-2026-44724 affects version 5.31.0 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.0",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50289 affects version 5.31.0 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-50289"
      },
      "action_statement": "Vulnerability CVE-2026-50289 affects version 5.31.0 of systeminformation."
    }
  ]
}