CVE-2026-26280

NameCVE-2026-26280
Descriptionsysteminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jupyterlab (PTS)trixie4.0.11+ds1+~cs11.25.27-7vulnerable
forky4.0.11+ds5+~cs11.25.27-1fixed
sid4.0.13+ds1+~2.0.1+~cs1.4.4-1fixed
node-systeminformation (PTS)forky5.31.6-4fixed
sid5.31.7-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jupyterlabsource(unstable)4.0.11+ds5+~cs11.25.27-1
node-systeminformationsource(unstable)(not affected)

Notes

- node-systeminformation <not-affected> (Fixed before initial upload to Debian)
node-systeminformation split from jupyterlab

Search for package or bug name: Reporting problems