GHSA-5vv4-hvf7-2h46
High · 8.8CVSS
8.8
EPSS
—
Published
Feb 18, 2026
CISA due date
—
The record
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | systeminformation | 0 | 5.31.0 |
Related vulnerabilities
- CVE-2026-26318 systeminformation is a System and OS information library for node.js. Same vulnerability
- CVE-2026-44724 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- GHSA-hvx9-hwr7-wjj9 Systeminformation vulnerable to Linux command injection in networkInterfaces() via… Also affects systeminformation
- CVE-2026-26280 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- GHSA-9c88-49p5-5ggf Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js… Also affects systeminformation
- GHSA-wphj-fx3q-84ch systeminformation has a Command Injection vulnerability in fsSize() function on Windows Also affects systeminformation
- CVE-2025-68154 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78