Packages / systeminformation / Security

HighVulnerabilityGHSA-9c88-49p5-5ggfCVE-2026-26280Published 18 Feb 2026

Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

Your version

Affected releases · systeminformation

  • 5.x5.0.0 – 5.30.7Fixed in 5.30.8
  • 4.x and older1.0.0 – 4.34.23No fix, no longer updated

On 5.x, the newest line:

npm install systeminformation@5.30.8
Every release on a timeline
5.x

  1. Affected

    5.0.0 – 5.30.7

    336 releases

  2. Fixed

    5.30.8 – 5.33.18

    39 releases, latest

4.x

  1. Affected

    4.0.0 – 4.34.23

    209 releases

3.x

  1. Affected

    3.0.0 – 3.54.0

    177 releases

2.x

  1. Affected

    2.0.0 – 2.0.5

    6 releases

1.x

  1. Affected

    1.0.0 – 1.0.7

    8 releases

775 stable releases of systeminformation, oldest to newest, one row per major.

What happens

Summary

A command injection vulnerability in the wifiNetworks() function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.

Details

In lib/wifi.js, the wifiNetworks() function sanitizes the iface parameter on the initial call (line 437). However, when the initial scan returns empty results, a setTimeout retry (lines 440-441) calls getWifiNetworkListIw(iface) with the original unsanitized iface value, which is passed directly to execSync('iwlist ${iface} scan').

PoC

  1. Install systeminformation@5.30.7

  2. Call si.wifiNetworks('eth0; id')

  3. The first call sanitizes input, but if results are empty, the retry executes: iwlist eth0; id scan

Impact

Remote Code Execution (RCE). Any application passing user-controlled input to si.wifiNetworks() is vulnerable to arbitrary command execution with the privileges of the Node.js process.