UBUNTU-CVE-2026-26280

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-26280

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26280.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-26280

Upstream

CVE-2026-26280

Published

2026-02-19T20:25:00Z

Modified

2026-06-12T09:04:05.811093994Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the wifiNetworks() function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In lib/wifi.js, the wifiNetworks() function sanitizes the iface parameter on the initial call (line 437). However, when the initial scan returns empty results, a setTimeout retry (lines 440-441) calls getWifiNetworkListIw(iface) with the original unsanitized iface value, which is passed directly to execSync('iwlist ${iface} scan'). Any application passing user-controlled input to si.wifiNetworks() is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.

References

Affected packages

Ubuntu:25.10 / jupyterlab

Package

Name: jupyterlab
Purl: pkg:deb/ubuntu/jupyterlab?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.0.11+ds1+~cs11.25.27-5

4.0.11+ds1+~cs11.25.27-6

4.0.11+ds1+~cs11.25.27-7

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "4.0.11+ds1+~cs11.25.27-7",
            "binary_name": "jupyterlab"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26280.json"

Ubuntu:26.04:LTS / jupyterlab