CVE-2026-26280: systeminformation Library RCE Vulnerability

CVE-2026-26280 Overview

CVE-2026-26280 is a command injection vulnerability affecting the systeminformation library, a popular System and OS information library for Node.js. The vulnerability exists in the wifiNetworks() function, which allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.

In lib/wifi.js, the wifiNetworks() function sanitizes the iface parameter on the initial call (line 437). However, when the initial scan returns empty results, a setTimeout retry (lines 440-441) calls getWifiNetworkListIw(iface) with the original unsanitizediface value, which is passed directly to execSync('iwlist ${iface} scan'). Any application passing user-controlled input to si.wifiNetworks() is vulnerable to arbitrary command execution with the privileges of the Node.js process.

Critical Impact

Attackers can achieve arbitrary command execution on the underlying operating system with the privileges of the Node.js process, potentially leading to full system compromise.

Affected Products

• systeminformation versions prior to 5.30.8 (Linux)
• Node.js applications utilizing vulnerable systeminformation versions
• Applications passing user-controlled input to si.wifiNetworks()

Discovery Timeline

• 2026-02-14 - Version 5.30.8 released with security fix
• 2026-02-19 - CVE-2026-26280 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-26280

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as command injection. The flaw stems from an inconsistency in input sanitization between the initial code path and the retry logic in the wifiNetworks() function.

When an application calls si.wifiNetworks() with user-controlled input for the network interface parameter, the function properly sanitizes this input on the initial execution. However, the vulnerability manifests when the initial wireless scan returns empty results, triggering a retry mechanism. This retry code path inadvertently uses the original, unsanitized iface parameter value, passing it directly to execSync() where it becomes part of the iwlist ${iface} scan command string.

An attacker can exploit this by crafting a malicious interface name containing shell metacharacters, which will be executed as arbitrary commands on the target system.

Root Cause

The root cause is inconsistent input validation between two code paths that handle the same user-supplied parameter. While the initial call sanitizes the iface parameter properly, the retry mechanism implemented via setTimeout bypasses this sanitization by directly using the original unsanitized value. This creates a race condition where empty scan results trigger the vulnerable code path.

Attack Vector

The attack requires local access and involves injecting shell metacharacters into the network interface parameter. An attacker can construct a payload such as ; malicious_command # or $(malicious_command) as the interface name. When the initial scan returns empty results, the retry path executes the command injection via the unsanitized parameter passed to execSync().

The attack vector is local, requiring no special privileges or user interaction. However, the attacker must be able to influence the input to the wifiNetworks() function, which typically occurs through application-level attack vectors such as API inputs or configuration parameters.

Detection Methods for CVE-2026-26280

Indicators of Compromise

• Unusual process execution spawned from Node.js processes, particularly commands following iwlist invocations
• Unexpected network interface names in system logs containing shell metacharacters like ;, $(), or backticks
• Node.js applications executing shell commands not typically associated with their functionality
• Evidence of reconnaissance or lateral movement commands executed with Node.js process privileges

Detection Strategies

• Monitor for process trees where node spawns unexpected child processes, especially shell commands
• Implement application-level logging to capture all inputs to si.wifiNetworks() function calls
• Use runtime application self-protection (RASP) solutions to detect command injection attempts
• Deploy file integrity monitoring on the systeminformation library to detect tampering

Monitoring Recommendations

• Enable verbose logging for Node.js applications utilizing systeminformation to capture interface parameter values
• Configure security information and event management (SIEM) rules to alert on anomalous shell command execution from Node.js processes
• Implement network segmentation to limit the impact of potential command execution
• Monitor for dependency version information in package.json and package-lock.json files to identify vulnerable installations

How to Mitigate CVE-2026-26280

Immediate Actions Required

• Upgrade systeminformation to version 5.30.8 or later immediately
• Audit applications for usage of si.wifiNetworks() with user-controlled input
• Implement input validation at the application layer for any interface name parameters
• Review and restrict privileges of Node.js processes to minimize potential impact

Patch Information

The vulnerability has been fixed in systeminformation version 5.30.8, released on 2026-02-14. The fix ensures consistent sanitization of the iface parameter across both the initial execution path and the retry code path. For full details, see the GitHub Security Advisory and the commit fixing the issue.

The patch documentation shows the following update:

                     </tr>
                   </thead>
                   <tbody>
+                    <tr>
+                      <th scope="row">5.30.8
+                      </th>
+                      <td>2026-02-14</td>
+                      <td><span class="code">wifiNetworks()</span> fixed CWE-78 command injection issue (linux)</td>
+                    </tr>
                     <tr>
                       <th scope="row">5.30.7
                       </th>

Source: GitHub Commit

Workarounds

• Avoid passing user-controlled input directly to si.wifiNetworks() until the patch is applied
• Implement strict allowlist validation for network interface names before passing to the function
• Run Node.js applications with minimal privileges using a dedicated service account
• Use containerization to isolate applications utilizing systeminformation from critical system resources

# Update systeminformation to patched version
npm update systeminformation@5.30.8

# Verify installed version
npm list systeminformation