CVE-2026-26280: systeminformation Library RCE Vulnerability

CVE-2026-26280 Overview

CVE-2026-26280 is a command injection vulnerability affecting the systeminformation library, a popular System and OS information library for Node.js. The vulnerability exists in the wifiNetworks() function, which allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.

In lib/wifi.js, the wifiNetworks() function sanitizes the iface parameter on the initial call (line 437). However, when the initial scan returns empty results, a setTimeout retry (lines 440-441) calls getWifiNetworkListIw(iface) with the original unsanitizediface value, which is passed directly to execSync('iwlist ${iface} scan'). Any application passing user-controlled input to si.wifiNetworks() is vulnerable to arbitrary command execution with the privileges of the Node.js process.

Critical Impact
Attackers can achieve arbitrary command execution on the underlying operating system with the privileges of the Node.js process, potentially leading to full system compromise.

Affected Products

systeminformation versions prior to 5.30.8 (Linux)
Node.js applications utilizing vulnerable systeminformation versions
Applications passing user-controlled input to si.wifiNetworks()

Discovery Timeline

2026-02-14 - Version 5.30.8 released with security fix
2026-02-19 - CVE-2026-26280 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-26280

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as command injection. The flaw stems from an inconsistency in input sanitization between the initial code path and the retry logic in the wifiNetworks() function.

When an application calls si.wifiNetworks() with user-controlled input for the network interface parameter, the function properly sanitizes this input on the initial execution. However, the vulnerability manifests when the initial wireless scan returns empty results, triggering a retry mechanism. This retry code path inadvertently uses the original, unsanitized iface parameter value, passing it directly to execSync() where it becomes part of the iwlist ${iface} scan command string.

An attacker can exploit this by crafting a malicious interface name containing shell metacharacters, which will be executed as arbitrary commands on the target system.

Root Cause

The root cause is inconsistent input validation between two code paths that handle the same user-supplied parameter. While the initial call sanitizes the iface parameter properly, the retry mechanism implemented via setTimeout bypasses this sanitization by directly using the original unsanitized value. This creates a race condition where empty scan results trigger the vulnerable code path.

Attack Vector

The attack requires local access and involves injecting shell metacharacters into the network interface parameter. An attacker can construct a payload such as ; malicious_command # or $(malicious_command) as the interface name. When the initial scan returns empty results, the retry path executes the command injection via the unsanitized parameter passed to execSync().

The attack vector is local, requiring no special privileges or user interaction. However, the attacker must be able to influence the input to the wifiNetworks() function, which typically occurs through application-level attack vectors such as API inputs or configuration parameters.

Detection Methods for CVE-2026-26280

Indicators of Compromise

Unusual process execution spawned from Node.js processes, particularly commands following iwlist invocations
Unexpected network interface names in system logs containing shell metacharacters like ;, $(), or backticks
Node.js applications executing shell commands not typically associated with their functionality
Evidence of reconnaissance or lateral movement commands executed with Node.js process privileges

Detection Strategies

Monitor for process trees where node spawns unexpected child processes, especially shell commands
Implement application-level logging to capture all inputs to si.wifiNetworks() function calls
Use runtime application self-protection (RASP) solutions to detect command injection attempts
Deploy file integrity monitoring on the systeminformation library to detect tampering

Monitoring Recommendations

Enable verbose logging for Node.js applications utilizing systeminformation to capture interface parameter values
Configure security information and event management (SIEM) rules to alert on anomalous shell command execution from Node.js processes
Implement network segmentation to limit the impact of potential command execution
Monitor for dependency version information in package.json and package-lock.json files to identify vulnerable installations

How to Mitigate CVE-2026-26280

Immediate Actions Required

Upgrade systeminformation to version 5.30.8 or later immediately
Audit applications for usage of si.wifiNetworks() with user-controlled input
Implement input validation at the application layer for any interface name parameters
Review and restrict privileges of Node.js processes to minimize potential impact

Patch Information

The vulnerability has been fixed in systeminformation version 5.30.8, released on 2026-02-14. The fix ensures consistent sanitization of the iface parameter across both the initial execution path and the retry code path. For full details, see the GitHub Security Advisory and the commit fixing the issue.

The patch documentation shows the following update:

text

                     </tr>
                   </thead>
                   <tbody>
+                    <tr>
+                      <th scope="row">5.30.8
+                      </th>
+                      <td>2026-02-14</td>
+                      <td><span class="code">wifiNetworks()</span> fixed CWE-78 command injection issue (linux)</td>
+                    </tr>
                     <tr>
                       <th scope="row">5.30.7
                       </th>

Source: GitHub Commit

Workarounds

Avoid passing user-controlled input directly to si.wifiNetworks() until the patch is applied
Implement strict allowlist validation for network interface names before passing to the function
Run Node.js applications with minimal privileges using a dedicated service account
Use containerization to isolate applications utilizing systeminformation from critical system resources

bash

# Update systeminformation to patched version
npm update systeminformation@5.30.8

# Verify installed version
npm list systeminformation