Read the docs
TI-2026-21249 Aliases CVE-2026-26280GHSA-9c88-49p5-5ggf

Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01371 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial systeminformation (sebhildebrandt): 5.30.8systeminformation (npm): 5.30.8Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sebhildebrandtsysteminformationbefore 5.30.85.30.8Patch availableCNA
—systeminformation (npm)before 5.30.85.30.8Patch availableGHSA-9c88-49p5-5ggf
  • systeminformation Vendorsebhildebrandt Affected before 5.30.8 Fixed in 5.30.8 Patch available CNA
  • systeminformation (npm) Vendor— Affected before 5.30.8 Fixed in 5.30.8 Patch available GHSA-9c88-49p5-5ggf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*before 5.30.8Vulnerablesebhildebrandt
  • cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:* Versions before 5.30.8 Vulnerable ·sebhildebrandt

Remediation

  • Fix · CNA systeminformation (sebhildebrandt) Fixed in 5.30.8
  • Fix · GHSA-9c88-49p5-5ggf systeminformation (npm) Fixed in 5.30.8 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26280
  2. 2026-10-03 Alias added: GHSA-9c88-49p5-5ggf
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2021-04415 Command injection in sebhildebrandt systeminformation KEVCVSS 3.1HIGH 7.8
  • TI-2026-37031 systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux CVSS 4.0HIGH 8.7
  • TI-2023-22901 systeminformation SSID Command Injection Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-41734 Command Injection in fsSize() on Windows CVSS 3.1HIGH 8.1
  • TI-2020-06270 Command injection in systeminformation CVSS 3.1HIGH 8.8
  • TI-2021-04487 Command Injection Vulnerability in systeminformation CVSS 3.1CRITICAL 9.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences