https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 15:41:26 +0000 https://vulnerability.circl.lu/vuln/ghsa-9c88-49p5-5ggf <p><strong>Affected:</strong> npm: systeminformation</p> <p>### Summary A command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.</p> <p>### Details In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync(&#39;iwlist ${iface} scan&#39;)`.</p> <p>### PoC 1. Install `systeminformation@5.30.7` 2. Call `si.wifiNetworks(&#39;eth0; id&#39;)` 3. The first call sanitizes input, but if results are empty, the retry executes: `iwlist eth0; id scan`</p> <p>### Impact Remote Code Execution (RCE). Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process.</p> <p><strong>Affected:</strong> npm: systeminformation</p> <p>### Summary A command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.</p> <p>### Details In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync(&#39;iwlist ${iface} scan&#39;)`.</p> <p>### PoC 1. Install `systeminformation@5.30.7` 2. Call `si.wifiNetworks(&#39;eth0; id&#39;)` 3. The first call sanitizes input, but if results are empty, the retry executes: `iwlist eth0; id scan`</p> <p>### Impact Remote Code Execution (RCE). Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process.</p> https://vulnerability.circl.lu/vuln/ghsa-9c88-49p5-5ggf