CVE-2026-26280

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.

• CWE-78
• CWE-78

• https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460Patch
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggfExploit, Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-26280
• https://bugzilla.redhat.com/show_bug.cgi?id=2441121
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26280.json

Published

Feb 19, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26274October is a Content Management System (CMS) and web platfor…6.6
• CVE-2026-26275httpsig-hyper is a hyper extension for http message signatur…7.5
• CVE-2026-26276Gogs is an open source self-hosted Git service. Prior to ver…5.4
• CVE-2026-26278fast-xml-parser allows users to validate XML, parse XML to J…7.5
• CVE-2026-26279Froxlor is open source server administration software. Prior…9.1
• CVE-2026-2628The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login…9.8
• CVE-2026-26281InvoicePlane is a self-hosted open source application for ma…4.4
• CVE-2026-26282NanaZip is an open source file archive Starting in version 5…6.6
• CVE-2026-26283ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-26284ImageMagick is free and open-source software used for editin…9.1
• CVE-2026-26286SillyTavern is a locally installed user interface that allow…8.5
• CVE-2026-26288WebSocket endpoints lack proper authentication mechanisms, e…9.8