CVE-2026-26318: sebhildebrandt systeminformation OS Command Injection
CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2026-26318DEBIAN-CVE-2026-26318GHSA-5vv4-hvf7-2h46CGA-24xh-85hm-x338CGA-2rvg-hr6f-8cx7CGA-3mf7-3757-mfw2CGA-3r8p-w7jh-89r8CGA-42p5-468r-677pCGA-4643-2cxp-2m4vCGA-48wg-qxh8-g5hcCGA-4qpq-967x-94vjCGA-5q55-c3hh-hm5rCGA-62cm-657x-jqwvCGA-6x22-xxw8-2vfpCGA-93qq-hrgq-r7w2CGA-97h3-f469-wf34CGA-9frp-64rw-747rCGA-9hx9-x9c9-wr23CGA-f456-v9g5-fhggCGA-f8j2-76gp-8mfrCGA-fhvv-4h95-cmffCGA-fprm-6pwm-36fcCGA-g397-fc5g-q364CGA-g76w-j5gw-g78vCGA-gpr7-f6g7-mvv8CGA-h4x2-rmwh-rvp6CGA-h9m6-wrhj-r66vCGA-j5gr-w2c4-qfhhCGA-jv9f-h6p4-wj7fCGA-m4rg-m846-6hjcCGA-mv4q-vpj7-wf6mCGA-ppvx-q677-q6x9CGA-qg8r-wrc3-x3xjCGA-qv2f-5f2h-2q7fCGA-rj9q-2jfr-4vqrCGA-rw6p-x25g-wmp7CGA-rx66-vppw-wgjfCGA-xfgj-rvgv-9fwpCGA-xp64-85f9-954q
Published 19-02-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-26318 is a high (CVSS 8.8) OS Command Injection vulnerability in sebhildebrandt systeminformation. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
1.42%
0%100%
Low · +0.25 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 19-02-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.42%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
+0.25 pp
From 1.17% on 18-09-2026
18-09-202618-10-2026
EPSS score1.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSysteminformation
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard18 products
- gemini-cli< 0.49.0-r4
- kibana-8.18All versions (No fix recorded)
- kibana-8.18-bitnamiAll versions (No fix recorded)
- kibana-8.18-iamguardedAll versions (No fix recorded)
- kibana-8.19< 8.19.11-r1
Ubuntu2 products
- jupyterlabAll versions (No fix recorded)
- node-systeminformationAll versions (No fix recorded)
Debian1 product
- jupyterlabAll versions (No fix recorded) | < 4.0.11+ds5+~cs11.25.27-1
Npm1 product
- systeminformation< 5.31.0
Sebhildebrandt1 product
- systeminformation< 5.31.0
Systeminformation1 product
- systeminformation< 5.31.0
6 vendors · 24 products
References
11 links- github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5vv4-hvf7-2h46X Refsource CONFIRMWEBAdvisoryExploitMitigationVendor Advisory
- github.com/sebhildebrandt/systeminformation/commit/b67d3715eec881038ccbaace2f2711419ac3e107X Refsource MISCWEBFIXPatch
