GHSA-9c88-49p5-5ggf

A command injection vulnerability in the wifiNetworks() function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.

Details

In lib/wifi.js, the wifiNetworks() function sanitizes the iface parameter on the initial call (line 437). However, when the initial scan returns empty results, a setTimeout retry (lines 440-441) calls getWifiNetworkListIw(iface) with the original unsanitized iface value, which is passed directly to execSync('iwlist ${iface} scan').

PoC

Install systeminformation@5.30.7
Call si.wifiNetworks('eth0; id')
The first call sanitizes input, but if results are empty, the retry executes: iwlist eth0; id scan

Impact

Remote Code Execution (RCE). Any application passing user-controlled input to si.wifiNetworks() is vulnerable to arbitrary command execution with the privileges of the Node.js process.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed_at": "2026-02-18T21:51:26Z",
    "nvd_published_at": "2026-02-19T20:25:43Z",
    "severity": "HIGH"
}

References

Affected packages

npm / systeminformation

Package

Name: systeminformation; View open source insights on deps.dev
Purl: pkg:npm/systeminformation

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.30.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-9c88-49p5-5ggf/GHSA-9c88-49p5-5ggf.json"