CVE-2024-56334

Name	CVE-2024-56334
Description	systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the `getWindowsIEEE8021x` function. This means that malicious content in the SSID can be executed as OS commands. This vulnerability may enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalation. This issue has been addressed in version 5.23.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jupyterlab (PTS)	trixie	4.0.11+ds1+~cs11.25.27-7	vulnerable
	forky	4.0.11+ds5+~cs11.25.27-1	fixed
	sid	4.0.13+ds1+~2.0.1+~cs1.4.4-1	fixed
node-systeminformation (PTS)	forky	5.31.6-4	fixed
	sid	5.31.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jupyterlab	source	(unstable)	4.0.11+ds5+~cs11.25.27-1
node-systeminformation	source	(unstable)	(not affected)

- node-systeminformation <not-affected> (Fixed before initial upload to Debian)
node-systeminformation split from jupyterlab