Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path
Summary
A command injection vulnerability in the wifiNetworks() function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.
Details
In lib/wifi.js, the wifiNetworks() function sanitizes the iface parameter on the initial call (line 437). However, when the initial scan returns empty results, a setTimeout retry (lines 440-441) calls getWifiNetworkListIw(iface) with the original unsanitized iface value, which is passed directly to execSync('iwlist ${iface} scan').
PoC
- Install
systeminformation@5.30.7 - Call
si.wifiNetworks('eth0; id') - The first call sanitizes input, but if results are empty, the retry executes:
iwlist eth0; id scan
Impact
Remote Code Execution (RCE). Any application passing user-controlled input to si.wifiNetworks() is vulnerable to arbitrary command execution with the privileges of the Node.js process.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | systeminformation | < 5.30.8 | 5.30.8 |
References
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-78- Platform
- npm
- Package
systeminformation- Disclosed
- 18.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9c88-49p5-5ggf - CC BY 4.0
Vulnerability history: systeminformation
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 10.2020 07.2026
- Without a fix
- 0
- Exploited in attacks
- 1
Severity breakdown
- Critical 1
- High 10
- Medium 3
Disclosures per year
- 2020: 4
- 2021: 2
- 2022: 1
- 2023: 1
- 2024: 1
- 2025: 1
- 2026: 4
-
Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.