CVE-2026-26318

HIGH

8.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2026-02-19

Last Modified2026-07-15

Data SourcesNVD

Vulnerability Description

systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 https://github.com/sebhildebrandt/systeminformation/commit/b67d3715eec881038ccbaace2f2711419ac3e107

🔗 https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5vv4-hvf7-2h46

🔗 https://access.redhat.com/security/cve/CVE-2026-26318

🔗 https://bugzilla.redhat.com/show_bug.cgi?id=2441124

🔗 https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26318.json

Vulnerability Description

Affected Platforms (CPE)

References & Advisories

関連する脆弱性情報