In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26274.json"