| Name | CVE-2026-26318 |
| Description | systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| jupyterlab (PTS) | trixie | 4.0.11+ds1+~cs11.25.27-7 | vulnerable |
| forky | 4.0.11+ds5+~cs11.25.27-1 | fixed |
| sid | 4.0.13+ds1+~2.0.1+~cs1.4.4-1 | fixed |
| node-systeminformation (PTS) | forky | 5.31.6-4 | fixed |
| sid | 5.31.7-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
- node-systeminformation <not-affected> (Fixed before initial upload to Debian)
node-systeminformation split from jupyterlab