Skip to content
OpenAdvisories
High · 8.4 CVE-2026-26280 EUVD-2026-7969GHSA-9c88-49p5-5ggf

Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

Published Feb 19, 2026 · Updated Jul 15, 2026 · Assigned by GitHub_M

Description

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.

Affected products

VendorProductAffectedFixed
sebhildebrandt systeminformation < 5.30.8 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jupyterlab 4.0.11+ds5+~cs11.25.27-1 —
Debian 13 jupyterlab No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jupyterlab +1 No fix yet —
Ubuntu 26.04 LTS jupyterlab No fix yet —
Ubuntu 25.10 jupyterlab No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
npm systeminformation < 5.30.8 5.30.8 GHSA-9c88-49p5-5ggf

References