CVE-2026-26280

CVE-2026-26280 is a command injection vulnerability in the systeminformation library for Node.js, affecting versions prior to 5.30.8. An attacker can execute arbitrary OS commands by providing a malicious network interface parameter to the wifiNetworks() function, specifically when the initial scan fails and the retry mechanism is triggered with an unsanitized value. This vulnerability carries a CVSS score of 7.8 (High), indicating a local attack vector with low complexity, potentially leading to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or KEV listing, the vulnerability has garnered some community discussion, and affected systems should be updated to version 5.30.8 or later.