{
  "@id": "urn:uuid:4afc8759-fc16-4eca-8af8-1648d7d160c9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:57:49.342266+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-26245 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26245"
      },
      "action_statement": "Vulnerability CVE-2020-26245 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2020-26274 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26274"
      },
      "action_statement": "Vulnerability CVE-2020-26274 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2020-26300 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26300"
      },
      "action_statement": "Vulnerability CVE-2020-26300 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-7752 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-7752"
      },
      "action_statement": "Vulnerability CVE-2020-7752 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-7778 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-7778"
      },
      "action_statement": "Vulnerability CVE-2020-7778 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:05:56.841018+00:00",
      "status_notes": "Vulnerability CVE-2021-21315 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2021-21315"
      },
      "action_statement": "Vulnerability CVE-2021-21315 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2021-21388 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2021-21388"
      },
      "action_statement": "Vulnerability CVE-2021-21388 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:07:18.587233+00:00",
      "status_notes": "Vulnerability CVE-2023-42810 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2023-42810"
      },
      "action_statement": "Vulnerability CVE-2023-42810 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2024-56334 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2024-56334"
      },
      "action_statement": "Vulnerability CVE-2024-56334 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-11-13T19:56:51.545945+00:00",
      "status_notes": "Vulnerability CVE-2025-68154 does not affect version 5.31.4 of systeminformation. not_affected \u2014 The target (systeminformation 5.31.4) already contains the upstream fix. fsSize() in lib/filesystem.js sanitizes the drive parameter with util.sanitizeShellString(drive, true) before building the PowerShell command. The fix is upstream commit c52f9fd0, which shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-68154"
      },
      "impact_statement": "not_affected \u2014 The target (systeminformation 5.31.4) already contains the upstream fix. fsSize() in lib/filesystem.js sanitizes the drive parameter with util.sanitizeShellString(drive, true) before building the PowerShell command. The fix is upstream commit c52f9fd0, which shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T04:17:38.235616+00:00",
      "status_notes": "Vulnerability CVE-2026-116576 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116576"
      },
      "action_statement": "Vulnerability CVE-2026-116576 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T01:53:34.860114+00:00",
      "status_notes": "Vulnerability CVE-2026-116673 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116673"
      },
      "action_statement": "Vulnerability CVE-2026-116673 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-10-29T01:54:26.951601+00:00",
      "status_notes": "Vulnerability CVE-2026-116674 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116674"
      },
      "action_statement": "Vulnerability CVE-2026-116674 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:49.342266+00:00",
      "status_notes": "Vulnerability CVE-2026-26280 does not affect version 5.31.4 of systeminformation. not_affected \u2014 The target (systeminformation 5.31.4) already contains the upstream fix for CVE-2026-26280. In lib/wifi.js wifiNetworks(), the delayed retry calls getWifiNetworkListIw(ifaceSanitized), the sanitized value, not the raw iface. The fix is upstream commit 22242aa5 (author hildebrandt@plus-innovations.com), which is an ancestor of HEAD. HEAD has no commit from a TuxCare/CloudLinux author domain, so ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-26280"
      },
      "impact_statement": "not_affected \u2014 The target (systeminformation 5.31.4) already contains the upstream fix for CVE-2026-26280. In lib/wifi.js wifiNetworks(), the delayed retry calls getWifiNetworkListIw(ifaceSanitized), the sanitized value, not the raw iface. The fix is upstream commit 22242aa5 (author hildebrandt@plus-innovations.com), which is an ancestor of HEAD. HEAD has no commit from a TuxCare/CloudLinux author domain, so ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:49.342266+00:00",
      "status_notes": "Vulnerability CVE-2026-26318 does not affect version 5.31.4 of systeminformation. not_affected \u2014 The upstream fix for CVE-2026-26318 (commit b67d3715, Sebastian Hildebrandt) is already in the target, 5.31.4. versions() in lib/osinfo.js now filters `locate bin/postgres` output through the safe-path regex /^[a-zA-Z0-9/_.-]+$/ and runs the chosen binary with execFile(path, ['-V']) instead of a shell-concatenated exec(). The commit predates the first TuxCare automation commit, so this is an up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-26318"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-26318 (commit b67d3715, Sebastian Hildebrandt) is already in the target, 5.31.4. versions() in lib/osinfo.js now filters `locate bin/postgres` output through the safe-path regex /^[a-zA-Z0-9/_.-]+$/ and runs the chosen binary with execFile(path, ['-V']) instead of a shell-concatenated exec(). The commit predates the first TuxCare automation commit, so this is an up..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44724 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-44724"
      },
      "action_statement": "Vulnerability CVE-2026-44724 affects version 5.31.4 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.4",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50289 affects version 5.31.4 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-50289"
      },
      "action_statement": "Vulnerability CVE-2026-50289 affects version 5.31.4 of systeminformation."
    }
  ]
}