{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T13:20:48.848","vulnerabilities":[{"cve":{"id":"CVE-2026-26280","sourceIdentifier":"security-advisories@github.com","published":"2026-02-19T20:25:43.880","lastModified":"2026-07-15T02:19:01.387","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue."},{"lang":"es","value":"systeminformation es una biblioteca de información del sistema y del SO para node.js. En versiones anteriores a la 5.30.8, una vulnerabilidad de inyección de comandos en la función wifiNetworks() permite a un atacante ejecutar comandos arbitrarios del SO a través de un parámetro de interfaz de red no saneado en la ruta de código de reintento. En lib/wifi.js, la función wifiNetworks() sanea el parámetro iface en la llamada inicial (línea 437). Sin embargo, cuando el escaneo inicial devuelve resultados vacíos, un reintento de setTimeout (líneas 440-441) llama a getWifiNetworkListIw(iface) con el valor iface original no saneado, que se pasa directamente a execSync('iwlist ${iface} scan'). Cualquier aplicación que pasa una entrada controlada por el usuario a si.wifiNetworks() es vulnerable a la ejecución arbitraria de comandos con los privilegios del proceso de Node.js. La versión 5.30.8 corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sebhildebrandt","product":"systeminformation","versions":[{"version":"< 5.30.8","status":"affected"}]}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","affectedData":[{"vendor":"Red Hat","product":"Red Hat Developer Hub","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhdh/rhdh-hub-rhel9","cpes":["cpe:/a:redhat:rhdh:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-19T20:57:36.955821Z","id":"CVE-2026-26280","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*","versionEndExcluding":"5.30.8","matchCriteriaId":"7FB14590-E6DA-4F97-9445-43E061CAA080"}]}]}],"references":[{"url":"https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26280","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441121","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26280.json","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}]}}]}