How many CVEs have patched toString?

2 published CVEs changed toString in sebhildebrandt/systeminformation, in 2 distinct patches totalling 82 changed lines, between 2025 and 2026.

What is the latest CVE that changed toString?

CVE-2026-26318 (systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`), published 2026-02-19, changed lines 772 to 779 of lib/osinfo.js.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

RadicalNotion.AI

Log in Create an account

sebhildebrandt/systeminformation

Function

2 files

toString

Name: toString in sebhildebrandt/systeminformation: CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Defined in 2 files

Last patched February 19, 2026

2

CVEs

That changed this function

2

Distinct patches

Backports counted once

82

Lines changed

Added plus removed

2025–2026

Years

By CVE publication date

Overview

toString in sebhildebrandt/systeminformation was changed by 2 published CVE fixes between 2025 and 2026, in 2 distinct patches that added or removed 82 lines in total.

The name occurs in 2 files: lib/filesystem.js, lib/osinfo.js.

sebhildebrandt/systeminformation has 13 CVEs with a located fix in total, so 15% of them touched this function.

CVEs that patched it

Every published CVE whose fix changed toString, newest first, with the lines each fix touched.

systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`
CVE-2026-26318 · lib/osinfo.js · lines 772–779 · +7 −2
High · CVSS 8.8
EPSS 1.3%2026-02-19
Command Injection in fsSize() on Windows
CVE-2025-68154 · lib/filesystem.js · lines 132–1241 · +45 −28 in 3 hunks
High · CVSS 8.1
EPSS 13.0%2025-12-16

Get an alert when the next CVE fix lands in sebhildebrandt/systeminformation, with the patched functions.

Monitor systeminformation CVEs

Other functions in these files

Functions in the same files that CVE fixes also changed.

Other hotspots in the repository

Functions in sebhildebrandt/systeminformation changed by the most CVE fixes.

inetChecksite5 CVEs · lib/internet.js sanitizeShellString5 CVEs · lib/util.js services4 CVEs · lib/processes.js networkStatsSingle3 CVEs · lib/network.js processLoad3 CVEs · lib/processes.js inetLatency3 CVEs · lib/internet.js

All patched functions in sebhildebrandt/systeminformation

Frequently asked questions

Common questions about CVE fixes to toString.

How many CVEs have patched toString?: 2 published CVEs changed toString in sebhildebrandt/systeminformation, in 2 distinct patches totalling 82 changed lines, between 2025 and 2026.
What is the latest CVE that changed toString?: CVE-2026-26318 (systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`), published 2026-02-19, changed lines 772 to 779 of lib/osinfo.js.
How does toString compare to the rest of sebhildebrandt/systeminformation?: sebhildebrandt/systeminformation has 13 CVEs with a located fix in total; 2 of them changed toString.
What do the line numbers refer to?: Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track sebhildebrandt/systeminformation CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing