CVE-2026-26280
Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path
Impact
### Summary A command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. ### Details In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. ### PoC 1. Install `systeminformation@5.30.7` 2. Call `si.wifiNetworks('eth0; id')` 3. The first call sanitizes input, but if results are empty, the retry executes: `iwlist eth0; id scan` ### Impact Remote Code Execution (RCE). Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | systeminformation | < 5.30.8 | 5.30.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Systeminformation | Systeminformation | before 5.30.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf
- https://access.redhat.com/security/cve/CVE-2026-26280
- https://bugzilla.redhat.com/show_bug.cgi?id=2441121
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26280.json
- https://github.com/advisories/GHSA-9c88-49p5-5ggf
- https://nvd.nist.gov/vuln/detail/CVE-2026-26280