CVE-2026-26280: systeminformation Command Injection Vulnerability in wifi.js
Summary
CVE-2026-26280: Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path. Affects systeminformation versions < 5.30.8. Fixed in 5.30.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'systeminformation' package is a popular Node.js library that provides detailed information about system hardware and operating system. It offers various functionalities, including network information retrieval through the 'wifiNetworks()' function. However, a vulnerability exists in this function that allows for command injection due to improper sanitization of input parameters, specifically in the retry logic when initial scans return empty results.
Vulnerability Detail
A command injection vulnerability in the 'wifiNetworks()' function of the 'systeminformation' package allows attackers to execute arbitrary OS commands. This occurs because the 'iface' parameter is not properly sanitized during a retry mechanism when the initial scan yields no results. The unsanitized input is passed directly to the 'execSync' function, enabling remote code execution (RCE) with the privileges of the Node.js process. This vulnerability can be exploited by any application that allows user-controlled input to the 'si.wifiNetworks()' function, leading to severe security risks.
How To Fix
Latest published version: 5.33.16 as of 22 Oct 2026
npm install systeminformation@5.33.16Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.30.8
This is the first release that contains the fix.
npm install systeminformation@5.30.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing user-controlled input directly to the 'si.wifiNetworks()' function. Instead, validate and sanitize the input before calling the function to prevent command injection. For example, you can implement a simple validation check as follows:
const validInterfaces = ['eth0', 'wlan0'];
const iface = userInput;
if (validInterfaces.includes(iface)) {
si.wifiNetworks(iface);
} else {
console.error('Invalid network interface');
}
Conclusion
The 'systeminformation' package has a critical command injection vulnerability that can lead to remote code execution. It is essential to update to version 5.30.8 or later to mitigate this risk. Users should also consider implementing input validation as a temporary workaround until they can apply the patch.
See every vulnerability recorded for systeminformation →
FAQ
The vulnerability has a CVSS score of 8.4, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary commands on the server running the Node.js application.
Yes, version 5.30.8 and later of the 'systeminformation' package contains the necessary fixes for this vulnerability.
If an immediate update is not possible, implement input validation and sanitization as a workaround to mitigate the risk of command injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for systeminformation.
