CVE-2026-26280: Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

February 18, 2026 (updated February 19, 2026)

A command injection vulnerability in the wifiNetworks() function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.

References

github.com/advisories/GHSA-9c88-49p5-5ggf
github.com/sebhildebrandt/systeminformation
github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460
github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf
nvd.nist.gov/vuln/detail/CVE-2026-26280

Code Behaviors & Features

Detect and mitigate CVE-2026-26280 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →