Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M
CVE-2026-26280Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path
High 8.4
In plain English
A high-severity OS command injection in systeminformation from sebhildebrandt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | jupyterlab | no fix listed | DEBIAN-CVE-2026-26280 |
| Debian:14 | jupyterlab | 4.0.11+ds5+~cs11.25.27-1 | DEBIAN-CVE-2026-26280 |
| Ubuntu:25.10 | jupyterlab | no fix listed | UBUNTU-CVE-2026-26280 |
| Ubuntu:26.04:LTS | jupyterlab | no fix listed | UBUNTU-CVE-2026-26280 |
| Ubuntu:26.10 | jupyterlab | no fix listed | UBUNTU-CVE-2026-26280 |
| Ubuntu:26.10 | node-systeminformation | no fix listed | UBUNTU-CVE-2026-26280 |
| npm | systeminformation | 5.30.8 | GHSA-9c88-49p5-5ggf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sebhildebrandt | systeminformation | < 5.30.8 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf x_refsource_CONFIRM
- https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-26280 vdb-entry, x_refsource_REDHAT
- RHBZ#2441121 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26280.json x_sadp-csaf-vex