CVE catalog

CVE-2025-68154

DEBIAN-CVE-2025-68154

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
12.99% · Oct 25, 2026

systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjupyterlab134.0.11+ds1+~cs11.25.27-7vulnerable
Debianjupyterlab134.0.11+ds1+~cs11.25.27-8vulnerable
Debianjupyterlab134.0.11+ds1+~cs11.25.27-9vulnerable
Debianjupyterlab134.0.11+ds2+~cs11.25.27-1vulnerable
Debianjupyterlab134.0.11+ds2+~cs11.25.27-3vulnerable
Debianjupyterlab134.0.11+ds3+~cs11.25.27-1vulnerable
Debianjupyterlab134.0.11+ds4+~cs11.25.27-1vulnerable
Debianjupyterlab134.0.11+ds4+~cs11.25.27-2vulnerable
Debianjupyterlab134.0.11+ds4+~cs11.25.27-3vulnerable
Debianjupyterlab134.0.11+ds4+~cs11.25.27-4vulnerable
Debianjupyterlab134.0.11+ds5+~cs11.25.27-1vulnerable
Debianjupyterlab134.0.13+ds1+~2.0.1+~cs1.4.4-1vulnerable
Debianjupyterlab134.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-1vulnerable
Debianjupyterlab134.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-1vulnerable
Debianjupyterlab134.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-2vulnerable
Debianjupyterlab134.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-3vulnerable
Debianjupyterlab134.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-4vulnerable
Debianjupyterlab134.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-5vulnerable
Debianjupyterlab134.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-6vulnerable
Debianjupyterlab134.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-7vulnerable
Debianjupyterlab134.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8vulnerable
Debianjupyterlab134.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-1vulnerable
Debianjupyterlab134.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1vulnerable
Debianjupyterlab134.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-2vulnerable
Debianjupyterlab134.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3vulnerable
Debianjupyterlab134.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4vulnerable
Debianjupyterlab134.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-5vulnerable
Debianjupyterlab134.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-6vulnerable
Debianjupyterlab134.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1vulnerable
Debianjupyterlab144.0.11+ds1+~cs11.25.27-7vulnerable
Debianjupyterlab144.0.11+ds1+~cs11.25.27-8vulnerable
Debianjupyterlab144.0.11+ds1+~cs11.25.27-9vulnerable
Debianjupyterlab144.0.11+ds2+~cs11.25.27-1vulnerable
Debianjupyterlab144.0.11+ds2+~cs11.25.27-3vulnerable
Debianjupyterlab144.0.11+ds3+~cs11.25.27-1vulnerable
Debianjupyterlab144.0.11+ds4+~cs11.25.27-1vulnerable
Debianjupyterlab144.0.11+ds4+~cs11.25.27-2vulnerable
Debianjupyterlab144.0.11+ds4+~cs11.25.27-3vulnerable
Debianjupyterlab144.0.11+ds4+~cs11.25.27-4vulnerable
Debianjupyterlab144.0.11+ds5+~cs11.25.27-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjupyterlabdeb144.0.11+ds5+~cs11.25.27-1Not reportedDEBIAN-CVE-2025-68154Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [jupyterlab]Affected
    Details (2)

    • 4.0.11+ds1+~cs11.25.27-7 · all · trixie

      Affected

      pypi · jupyterlab · debian · 13

    • 4.0.11+ds1+~cs11.25.27-7 · all · trixie

      Affected

      pypi · jupyterlab · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]