CVE-2026-26318: systeminformation Command Injection RCE

CVE-2026-26318 Overview

CVE-2026-26318 is a command injection vulnerability affecting systeminformation, a popular System and OS information library for Node.js. The vulnerability exists in versions prior to 5.31.0 and allows attackers to inject arbitrary commands through unsanitized output from the locate command when processed by the versions() function.

Critical Impact

Attackers with local access can execute arbitrary commands on the system, potentially leading to complete system compromise, data theft, or lateral movement within affected environments.

Affected Products

• systeminformation versions prior to 5.31.0
• Node.js applications using vulnerable systeminformation library
• Systems running the versions() function with untrusted locate output

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-26318 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-26318

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in how the systeminformation library processes output from the locate command within its versions() function. When the library retrieves version information, it fails to properly sanitize the output before using it in subsequent command constructions.

An attacker who can influence the output of the locate command—either by placing maliciously named files on the filesystem or by exploiting other path-related mechanisms—can inject arbitrary shell commands that will be executed with the privileges of the Node.js process.

Root Cause

The root cause of this vulnerability is insufficient input sanitization in the versions() function. When processing results from the locate command to gather system information, the library concatenates or interpolates these values directly into shell command strings without proper escaping or validation. This allows special shell characters and command separators to be interpreted as executable commands rather than data.

Attack Vector

The attack vector requires local access to the system. An attacker must be able to create files with specially crafted names or otherwise influence the output that locate returns. Once the malicious filename or path is processed by the vulnerable versions() function, the embedded commands are executed. This could be exploited in scenarios where:

• Multi-user systems allow placing files in shared or indexed directories
• Applications process user-uploaded filenames without renaming
• The locate database includes paths from user-writable directories

The vulnerability enables command execution in the context of the Node.js application, which could lead to privilege escalation if the application runs with elevated permissions.

Detection Methods for CVE-2026-26318

Indicators of Compromise

• Unusual child processes spawned from Node.js applications, particularly shell commands with unexpected arguments
• Files with suspicious names containing shell metacharacters (;, |, $(), backticks) in directories indexed by locate
• Application logs showing unexpected command execution errors or shell syntax errors
• Network connections or file system access patterns inconsistent with normal application behavior

Detection Strategies

• Monitor Node.js application process trees for anomalous shell command execution patterns
• Implement file integrity monitoring on directories indexed by locate to detect maliciously named files
• Deploy application-level logging to capture versions() function calls and their outputs
• Use runtime application security monitoring to detect command injection attempts

Monitoring Recommendations

• Enable audit logging for process creation events, particularly those originating from Node.js processes
• Monitor for unusual patterns in locate command usage and output processing
• Implement network monitoring for unexpected outbound connections from Node.js applications
• Review application dependencies regularly using software composition analysis (SCA) tools

How to Mitigate CVE-2026-26318

Immediate Actions Required

• Update systeminformation to version 5.31.0 or later immediately
• Audit applications using the systeminformation library to identify vulnerable deployments
• Review the versions() function usage in your codebase and assess exposure
• Restrict file creation permissions in directories indexed by locate where possible

Patch Information

The vulnerability has been fixed in systeminformation version 5.31.0. The patch implements proper sanitization of locate output before it is used in command construction. The fix is available in commit b67d3715eec881038ccbaace2f2711419ac3e107. Detailed information about the vulnerability is available in the GitHub Security Advisory GHSA-5vv4-hvf7-2h46.

Workarounds

• Avoid using the versions() function in affected versions until patching is possible
• Implement application-level input validation if locate results are used elsewhere in your application
• Run Node.js applications with minimal privileges to limit the impact of command execution
• Consider containerization with restricted capabilities to limit potential damage from exploitation

# Update systeminformation to the patched version
npm update systeminformation@5.31.0

# Or explicitly install the fixed version
npm install systeminformation@5.31.0

# Verify the installed version
npm list systeminformation