# GHSA-9c88-49p5-5ggf: Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

**Severity:** HIGH | **CVSS:** 8.4 | **Source:** ghsa

## Description

### Summary
A command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.

### Details
In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`.

### PoC
1. Install `systeminformation@5.30.7`
2. Call `si.wifiNetworks('eth0; id')`
3. The first call sanitizes input, but if results are empty, the retry executes: `iwlist eth0; id scan`

### Impact
Remote Code Execution (RCE). Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process.

## CVSS

- **Score:** 8.4
- **Vector:** `CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Weakness

- [CWE-78](https://cwe.mitre.org/data/definitions/78.html)

## Affected Packages

### systeminformation (npm)
- **Vulnerable:** `< 5.30.8`
- **Fixed in:** `5.30.8`

## References

**Commits:**
- https://github.com/sebhildebrandt/systeminformation/commit/22242aa56188f2bffcbd7d265a11e1ebb808b460

**Advisories:**
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf
- https://github.com/advisories/GHSA-9c88-49p5-5ggf

## Related Identifiers

- CVE-2026-26280

---

**Source:** https://github.com/advisories/GHSA-9c88-49p5-5ggf
**Published:** 2026-02-18
**Ingested:** 2026-02-19 20:48:24 UTC

## Reproduction Steps

_To be determined by the reproduction agent._