[HIGH] CVE-2026-26280 — CVSS 8.4

A HIGH-severity vulnerability identified as CVE-2026-26280 has been published on February 19, 2026 with a CVSS base score of 8.4. The vulnerability affects Systeminformation Systeminformation. This security advisory provides a detailed breakdown of the vulnerability, its potential impact, weakness classification, and actionable steps to protect your systems.

Vulnerability Details

CVE ID: CVE-2026-26280
Severity: HIGH
CVSS Score: 8.4
Published: February 19, 2026
Affected Product: Systeminformation Systeminformation
Weakness (CWE): CWE-78

Technical Description

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.

Potential Impact

If exploited, this high-severity vulnerability could allow an attacker to compromise sensitive data confidentiality, tamper with system integrity, cause a denial of service. Organizations running Systeminformation Systeminformation should treat this as a priority remediation item.

Recommended Action

A patch or vendor advisory is available. Take the following steps immediately:

1. Review the vendor advisory linked in the References section below.
2. Identify all instances of the affected software in your environment.
3. Apply the available patch or upgrade to the fixed version as soon as possible.
4. If patching is not immediately possible, implement compensating controls such as WAF rules, network segmentation, or disabling the affected feature.
5. Monitor your systems for signs of exploitation using your SIEM or IDS/IPS.

View full details on NVD →

References

• Patch
• Exploit, Vendor Advisory

Related Security Advisories

• [HIGH] CVE-2026-27464 — CVSS 7.7 (February 21, 2026) — HIGH / CVSS 7.7
• [HIGH] CVE-2026-27466 — CVSS 7.2 (February 21, 2026) — HIGH / CVSS 7.2
• [HIGH] CVE-2026-26050 — CVSS 7.8 (February 20, 2026) — HIGH / CVSS 7.8