systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a     command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary     OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the     `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when     the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls     `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to     `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()`     is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8     fixes the issue. (CVE-2026-26280)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a
    command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary
    OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the
    `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when
    the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls
    `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to
    `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()`
    is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8
    fixes the issue. (CVE-2026-26280)

ID	Name	Product	Family	Severity
318542	Linux Distros Unpatched Vulnerability : CVE-2026-26280	Nessus	Misc.	high
437856	SCA: security update for systeminformation (GHSA-9c88-49p5-5ggf)	Tenable Cloud Security	SCA Checks	high
437856	SCA: security update for systeminformation (GHSA-9c88-49p5-5ggf)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-26280

high

Tenable Plugins

high

high

high