Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M
CVE-2026-26318systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`
High 8.8
In plain English
A high-severity OS command injection in systeminformation from sebhildebrandt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.3%top 29.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | jupyterlab | no fix listed | DEBIAN-CVE-2026-26318 |
| Debian:14 | jupyterlab | 4.0.11+ds5+~cs11.25.27-1 | DEBIAN-CVE-2026-26318 |
| Ubuntu:25.10 | jupyterlab | no fix listed | UBUNTU-CVE-2026-26318 |
| Ubuntu:26.04:LTS | jupyterlab | no fix listed | UBUNTU-CVE-2026-26318 |
| Ubuntu:26.10 | jupyterlab | no fix listed | UBUNTU-CVE-2026-26318 |
| Ubuntu:26.10 | node-systeminformation | no fix listed | UBUNTU-CVE-2026-26318 |
| npm | systeminformation | 5.31.0 | GHSA-5vv4-hvf7-2h46 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sebhildebrandt | systeminformation | < 5.31.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5vv4-hvf7-2h46 x_refsource_CONFIRM
- https://github.com/sebhildebrandt/systeminformation/commit/b67d3715eec881038ccbaace2f2711419ac3e107 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-26318 vdb-entry, x_refsource_REDHAT
- RHBZ#2441124 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26318.json x_sadp-csaf-vex