PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-26280 sebhildebrandt CVE debrief

The systeminformation library for Node.js, prior to version 5.30.8, contains a command injection vulnerability in the `wifiNetworks()` function. This vulnerability allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. The `wifiNetworks()` function in `lib/wifi.js` initially sanitizes the `iface` parameter but fails to do so in the retry logic, leading to potential command execution with the privileges of the Node.js process. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable. Version 5.30.8 fixes this issue.

Vendor
sebhildebrandt
Product
systeminformation
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-19
Original CVE updated
2026-07-15
Advisory published
2026-02-19
Advisory updated
2026-07-15

Who should care

Developers and administrators using the systeminformation library in Node.js applications should be aware of this vulnerability. Given the high CVSS score of 8.4, priority should be given to updating to version 5.30.8 or later to mitigate the risk of arbitrary command execution.

Technical summary

The vulnerability exists in the `wifiNetworks()` function of the systeminformation library. Specifically, the function does not properly sanitize the `iface` parameter in the retry logic, which leads to a command injection vulnerability. An attacker could exploit this by providing a specially crafted network interface parameter, allowing for the execution of arbitrary OS commands. The vulnerability is addressed in version 5.30.8 of the library.

Defensive priority

High priority should be given to updating the systeminformation library to version 5.30.8 or later. Developers should review applications that use `si.wifiNetworks()` and ensure that user-controlled input is properly sanitized.

Recommended defensive actions

  • Update the systeminformation library to version 5.30.8 or later.
  • Review applications using `si.wifiNetworks()` to ensure proper sanitization of user-controlled input.
  • Implement additional monitoring and logging to detect potential exploitation attempts.
  • Consider applying compensating controls, such as restricting access to the Node.js process.
  • Perform thorough inventory checks to identify potentially vulnerable systems.

Evidence notes

The CVE-2026-26280 record and associated references provide detailed information about the vulnerability. The NVD and CVE.org records confirm the high severity of the issue and provide additional context.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-26280 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-26280

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-26280 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-26280

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460

    [email protected] - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf

    [email protected] - Exploit, Vendor Advisory

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-26280

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26280.json

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.