{
  "@id": "urn:uuid:1a27a13c-839e-4535-b9da-871f24e609b0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:57:49.342266+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-26245 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26245"
      },
      "action_statement": "Vulnerability CVE-2020-26245 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2020-26274 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26274"
      },
      "action_statement": "Vulnerability CVE-2020-26274 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2020-26300 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26300"
      },
      "action_statement": "Vulnerability CVE-2020-26300 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-7752 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-7752"
      },
      "action_statement": "Vulnerability CVE-2020-7752 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-7778 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-7778"
      },
      "action_statement": "Vulnerability CVE-2020-7778 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:05:56.841018+00:00",
      "status_notes": "Vulnerability CVE-2021-21315 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2021-21315"
      },
      "action_statement": "Vulnerability CVE-2021-21315 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2021-21388 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2021-21388"
      },
      "action_statement": "Vulnerability CVE-2021-21388 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:07:18.587233+00:00",
      "status_notes": "Vulnerability CVE-2023-42810 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2023-42810"
      },
      "action_statement": "Vulnerability CVE-2023-42810 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2024-56334 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2024-56334"
      },
      "action_statement": "Vulnerability CVE-2024-56334 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:49.342266+00:00",
      "status_notes": "Vulnerability CVE-2025-68154 does not affect version 5.31.5 of systeminformation. not_affected \u2014 systeminformation 5.31.5 already contains the upstream fix for CVE-2025-68154. fsSize() in lib/filesystem.js sanitizes the drive argument with util.sanitizeShellString(drive, true) before it is placed in the PowerShell command. The fix is upstream commit c52f9fd0, which is an ancestor of HEAD and ships in the upstream release. HEAD has no TuxCare-authored fix commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-68154"
      },
      "impact_statement": "not_affected \u2014 systeminformation 5.31.5 already contains the upstream fix for CVE-2025-68154. fsSize() in lib/filesystem.js sanitizes the drive argument with util.sanitizeShellString(drive, true) before it is placed in the PowerShell command. The fix is upstream commit c52f9fd0, which is an ancestor of HEAD and ships in the upstream release. HEAD has no TuxCare-authored fix commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T04:17:38.235616+00:00",
      "status_notes": "Vulnerability CVE-2026-116576 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116576"
      },
      "action_statement": "Vulnerability CVE-2026-116576 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T01:53:34.860114+00:00",
      "status_notes": "Vulnerability CVE-2026-116673 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116673"
      },
      "action_statement": "Vulnerability CVE-2026-116673 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-10-29T01:54:26.951601+00:00",
      "status_notes": "Vulnerability CVE-2026-116674 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116674"
      },
      "action_statement": "Vulnerability CVE-2026-116674 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:49.342266+00:00",
      "status_notes": "Vulnerability CVE-2026-26280 does not affect version 5.31.5 of systeminformation. not_affected \u2014 The target (systeminformation 5.31.5) already contains the upstream fix for CVE-2026-26280. In lib/wifi.js, the setTimeout retry in wifiNetworks() calls getWifiNetworkListIw(ifaceSanitized) with the sanitized value, not the raw interface name. The fix is upstream commit 22242aa5 (author hildebrandt@plus-innovations.com), which is an ancestor of HEAD and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-26280"
      },
      "impact_statement": "not_affected \u2014 The target (systeminformation 5.31.5) already contains the upstream fix for CVE-2026-26280. In lib/wifi.js, the setTimeout retry in wifiNetworks() calls getWifiNetworkListIw(ifaceSanitized) with the sanitized value, not the raw interface name. The fix is upstream commit 22242aa5 (author hildebrandt@plus-innovations.com), which is an ancestor of HEAD and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-11-13T19:56:51.545945+00:00",
      "status_notes": "Vulnerability CVE-2026-26318 does not affect version 5.31.5 of systeminformation. not_affected \u2014 Target (systeminformation 5.31.5) already contains the upstream fix for CVE-2026-26318. The locate output in versions() is filtered against a safe-path regex and run via execFile (no shell). The fix is upstream commit b67d3715, authored by Sebastian Hildebrandt, and ships in the upstream release. HEAD has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-26318"
      },
      "impact_statement": "not_affected \u2014 Target (systeminformation 5.31.5) already contains the upstream fix for CVE-2026-26318. The locate output in versions() is filtered against a safe-path regex and run via execFile (no shell). The fix is upstream commit b67d3715, authored by Sebastian Hildebrandt, and ships in the upstream release. HEAD has no TuxCare-domain commits."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44724 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-44724"
      },
      "action_statement": "Vulnerability CVE-2026-44724 affects version 5.31.5 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.5",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50289 affects version 5.31.5 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-50289"
      },
      "action_statement": "Vulnerability CVE-2026-50289 affects version 5.31.5 of systeminformation."
    }
  ]
}