{"id":"GHSA-9c88-49p5-5ggf","summary":"Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path","details":"### Summary\nA command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.\n\n### Details\nIn `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`.\n\n### PoC\n1. Install `systeminformation@5.30.7`\n2. Call `si.wifiNetworks('eth0; id')`\n3. The first call sanitizes input, but if results are empty, the retry executes: `iwlist eth0; id scan`\n\n### Impact\nRemote Code Execution (RCE). Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process.","aliases":["CVE-2026-26280"],"modified":"2026-09-10T03:50:34.457556318Z","published":"2026-02-18T21:51:26Z","database_specific":{"github_reviewed_at":"2026-02-18T21:51:26Z","nvd_published_at":"2026-02-19T20:25:43Z","cwe_ids":["CWE-78"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26280"},{"type":"WEB","url":"https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460"},{"type":"PACKAGE","url":"https://github.com/sebhildebrandt/systeminformation"}],"affected":[{"package":{"name":"systeminformation","ecosystem":"npm","purl":"pkg:npm/systeminformation"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.30.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-9c88-49p5-5ggf/GHSA-9c88-49p5-5ggf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}