AIKIDO-2026-424247
systeminformation is vulnerable to Path Traversal
44
Medium Risk
This Affects:
systeminformationTL;DR
The Docker helper functions in systeminformation insert caller-supplied container and image identifiers directly into the HTTP request path sent to the Docker Engine socket API. The identifiers are only sanitized for shell metacharacters, so characters such as / and .. sequences survive, and an application that forwards externally influenced identifiers to functions like dockerContainerStats or dockerContainerProcesses can steer the request to unintended Docker API endpoints or parameters. This enables a confused-deputy style interaction with the privileged local Docker daemon socket. The fix adds dedicated sanitizeContainerID and sanitizeImageID helpers that restrict identifiers to a safe character set and reject path-traversal sequences before they reach the socket request.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and pass externally influenced container or image identifiers to the Docker helper functions.
Background info
systeminformation is vulnerable to Path Traversal in versions 3.7.0 - 5.31.17.
How to fix this
Upgrade the systeminformation library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant