{
  "@id": "urn:uuid:66b384c0-1098-4392-8fe5-c24f68b76d0b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:57:49.342266+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-26245 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26245"
      },
      "action_statement": "Vulnerability CVE-2020-26245 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2020-26274 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26274"
      },
      "action_statement": "Vulnerability CVE-2020-26274 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2020-26300 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-26300"
      },
      "action_statement": "Vulnerability CVE-2020-26300 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-7752 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-7752"
      },
      "action_statement": "Vulnerability CVE-2020-7752 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2020-7778 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2020-7778"
      },
      "action_statement": "Vulnerability CVE-2020-7778 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:05:56.841018+00:00",
      "status_notes": "Vulnerability CVE-2021-21315 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2021-21315"
      },
      "action_statement": "Vulnerability CVE-2021-21315 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2021-21388 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2021-21388"
      },
      "action_statement": "Vulnerability CVE-2021-21388 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:07:18.587233+00:00",
      "status_notes": "Vulnerability CVE-2023-42810 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2023-42810"
      },
      "action_statement": "Vulnerability CVE-2023-42810 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:04:28.598882+00:00",
      "status_notes": "Vulnerability CVE-2024-56334 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2024-56334"
      },
      "action_statement": "Vulnerability CVE-2024-56334 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:49.342266+00:00",
      "status_notes": "Vulnerability CVE-2025-68154 does not affect version 5.31.6 of systeminformation. not_affected \u2014 The fix for CVE-2025-68154 is already in the target. lib/filesystem.js:218-219 sanitizes the `drive` argument with util.sanitizeShellString(drive, true) before it is placed in the PowerShell command. The fix is upstream commit c52f9fd0 (\"fsSize() fix drive sanitation (windows)\"), authored by the upstream maintainer. HEAD's history has no TuxCare/CloudLinux commit, so this is an upstream fix shi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-68154"
      },
      "impact_statement": "not_affected \u2014 The fix for CVE-2025-68154 is already in the target. lib/filesystem.js:218-219 sanitizes the `drive` argument with util.sanitizeShellString(drive, true) before it is placed in the PowerShell command. The fix is upstream commit c52f9fd0 (\"fsSize() fix drive sanitation (windows)\"), authored by the upstream maintainer. HEAD's history has no TuxCare/CloudLinux commit, so this is an upstream fix shi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T04:17:38.235616+00:00",
      "status_notes": "Vulnerability CVE-2026-116576 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116576"
      },
      "action_statement": "Vulnerability CVE-2026-116576 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T01:53:34.860114+00:00",
      "status_notes": "Vulnerability CVE-2026-116673 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116673"
      },
      "action_statement": "Vulnerability CVE-2026-116673 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-10-29T01:54:26.951601+00:00",
      "status_notes": "Vulnerability CVE-2026-116674 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-116674"
      },
      "action_statement": "Vulnerability CVE-2026-116674 affects version 5.31.6 of systeminformation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:49.342266+00:00",
      "status_notes": "Vulnerability CVE-2026-26280 does not affect version 5.31.6 of systeminformation. not_affected \u2014 Not affected. In 5.31.6, wifiNetworks() sanitizes the interface name with util.sanitizeString(iface, true) before use, and the 4-second retry in setTimeout reuses that sanitized value (ifaceSanitized). The upstream fix 22242aa5 is an ancestor of HEAD and was already in the upstream 5.31.6 release. Its author is the upstream maintainer, not TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-26280"
      },
      "impact_statement": "not_affected \u2014 Not affected. In 5.31.6, wifiNetworks() sanitizes the interface name with util.sanitizeString(iface, true) before use, and the 4-second retry in setTimeout reuses that sanitized value (ifaceSanitized). The upstream fix 22242aa5 is an ancestor of HEAD and was already in the upstream 5.31.6 release. Its author is the upstream maintainer, not TuxCare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:00.034569+00:00",
      "status_notes": "Vulnerability CVE-2026-26318 does not affect version 5.31.6 of systeminformation. not_affected \u2014 systeminformation 5.31.6 already contains the upstream fix for CVE-2026-26318. versions() on Linux filters the `locate bin/postgres` output with a safe-path regex and runs the selected binary with execFile (no shell). The fix is upstream commit b67d3715 by the upstream author. It shipped in the 5.31.6 release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-26318"
      },
      "impact_statement": "not_affected \u2014 systeminformation 5.31.6 already contains the upstream fix for CVE-2026-26318. versions() on Linux filters the `locate bin/postgres` output with a safe-path regex and runs the selected binary with execFile (no shell). The fix is upstream commit b67d3715 by the upstream author. It shipped in the 5.31.6 release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-11-13T19:57:49.342266+00:00",
      "status_notes": "Vulnerability CVE-2026-44724 does not affect version 5.31.6 of systeminformation. not_affected \u2014 systeminformation 5.31.6 does not contain the CVE-2026-44724 pattern. The upstream-authored fix (Sebastian Hildebrandt, commits 78624d15, f69576f8, 1d1bddf8, 87dbb60f) is already in the release. The NetworkManager connection name is no longer interpolated into shell strings. All three sinks and the device-status lookup use execFileSync('nmcli', [...]) with argument arrays, and the connection na...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44724"
      },
      "impact_statement": "not_affected \u2014 systeminformation 5.31.6 does not contain the CVE-2026-44724 pattern. The upstream-authored fix (Sebastian Hildebrandt, commits 78624d15, f69576f8, 1d1bddf8, 87dbb60f) is already in the release. The NetworkManager connection name is no longer interpolated into shell strings. All three sinks and the device-status lookup use execFileSync('nmcli', [...]) with argument arrays, and the connection na..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/systeminformation@5.31.6",
          "identifiers": {
            "purl": "pkg:npm/systeminformation@5.31.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50289 affects version 5.31.6 of systeminformation.",
      "vulnerability": {
        "name": "CVE-2026-50289"
      },
      "action_statement": "Vulnerability CVE-2026-50289 affects version 5.31.6 of systeminformation."
    }
  ]
}