CVE-2026-26280
📋 TL;DR
This CVE describes a command injection vulnerability in the systeminformation Node.js library's wifiNetworks() function. Attackers can execute arbitrary OS commands by passing malicious input to the network interface parameter when the initial scan returns empty results. Any Node.js application using vulnerable versions of systeminformation and passing user-controlled input to wifiNetworks() is affected.
💻 Affected Systems
- systeminformation Node.js library
📦 What is this software?
Systeminformation by Systeminformation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the Node.js process, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or remote code execution in applications that expose wifiNetworks() functionality to user input, resulting in application compromise.
If Mitigated
Limited impact if input validation prevents user-controlled data from reaching the vulnerable function.
🎯 Exploit Status
Exploitation requires user input to reach the vulnerable function, but the injection itself is straightforward once that condition is met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.30.8
Vendor Advisory: https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf
Restart Required: Yes
Instructions:
1. Update systeminformation to version 5.30.8 or later using npm update systeminformation. 2. Restart all Node.js applications using the library. 3. Verify the update with npm list systeminformation.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation to prevent user-controlled data from being passed to wifiNetworks() function.
Function Restriction
allDisable or restrict access to wifiNetworks() functionality if not required.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all parameters passed to wifiNetworks()
- Run Node.js applications with minimal necessary privileges to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check if systeminformation version is below 5.30.8 using npm list systeminformationCheck Version:
npm list systeminformation | grep systeminformationVerify Fix Applied:
Confirm systeminformation version is 5.30.8 or higher using npm list systeminformation📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from Node.js processes
- Failed or unexpected iwlist scan commands
Network Indicators:
- Suspicious outbound connections from Node.js applications
SIEM Query:
process.name:node AND cmdline:*iwlist* AND cmdline:*scan*