Security Digest: December 16, 2025 - 2 Critical Vulnerabilities

Today, we highlight two critical vulnerabilities: an OS Command Injection in the 'systeminformation' library on Windows systems, and an arbitrary file read issue in the '@vitejs/plugin-rsc'.

· 3 min read

Today's Critical Security Threats

Stay informed of the latest vulnerabilities impacting your systems. Immediate actions are required to mitigate these threats and protect your infrastructure.

Executive Summary

Today, we highlight two critical vulnerabilities: an OS Command Injection in the 'systeminformation' library on Windows systems, and an arbitrary file read issue in the '@vitejs/plugin-rsc'. Immediate patches and mitigations are essential to safeguard your systems.

Critical Vulnerabilities

  • CVE-2025-68154: OS Command Injection in systeminformation
    • Impact: Allows remote attackers to execute arbitrary commands on Windows systems.
    • Affected Systems: Windows systems using 'systeminformation' with unsanitized user input.
    • Immediate Action: Sanitize user inputs in 'fsSize()' using 'util.sanitizeShellString()'.
    • Mitigation: Update to the latest patched version of 'systeminformation' or apply the recommended code fix.
  • CVE-2025-68155: Arbitrary File Read in @vitejs/plugin-rsc
    • Impact: Unauthorized users can read any file accessible to the Node.js process during development mode.
    • Affected Systems: Development environments using '@vitejs/plugin-rsc' with 'vite dev'.
    • Immediate Action: Restrict network access to development servers and review access permissions.
    • Mitigation: Await security patch or manually restrict file access to within the project directory.

What to Do Now

  1. Immediately update 'systeminformation' and '@vitejs/plugin-rsc' to their latest versions if available.
  2. Sanitize all inputs that interact with 'fsSize()' in 'systeminformation'.
  3. Restrict access to Vite development servers to trusted IP addresses only.
  4. Monitor network traffic for unusual activity related to these vulnerabilities.

Related Resources

  • Review the official advisories from npm regarding 'systeminformation' and 'vitejs'.
  • Stay tuned to our upcoming blog posts for deep dives into these vulnerabilities.

Keep reading