CVE-2026-26318
Fixed in a distro release EPSS 1%CVSS 8.8
systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.
Products: sebhildebrandt systeminformation, Red Hat Developer Hub
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | systeminformation | 5.31.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gemini-cli | 0.49.0-r4 |
| Chainguard | kibana-8.18 | no fix |
| Chainguard | kibana-8.18-bitnami | no fix |
| Chainguard | kibana-8.18-iamguarded | no fix |
| Chainguard | kibana-8.19 | 8.19.11-r1 |
| Chainguard | kibana-8.19-bitnami | 8.19.11-r1 |
| Chainguard | kibana-8.19-iamguarded | 8.19.11-r1 |
| Chainguard | kibana-9.0 | 9.0.8-r10 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r10 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r10 |
| Chainguard | kibana-9.1 | 9.1.10-r5 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r5 |
| Chainguard | kibana-9.2 | 9.2.5-r3 |
| Chainguard | kibana-9.2-iamguarded | 9.2.5-r3 |
| Chainguard | kibana-9.3 | 9.3.0-r1 |
| Chainguard | kibana-9.3-iamguarded | 9.3.0-r1 |
| Chainguard | kibana-9.4 | 9.4.2-r1 |
| Chainguard | kibana-9.4-iamguarded | 9.4.2-r1 |
| Debian 13 | jupyterlab | no fix |
| Debian 14 | jupyterlab | 4.0.11+ds5+~cs11.25.27-1 |
| Ubuntu 25.10 | jupyterlab | no fix |
| Ubuntu 26.04 LTS | jupyterlab | no fix |
| Ubuntu 26.10 | jupyterlab | no fix |
| Ubuntu 26.10 | node-systeminformation | no fix |