{"id":"EUVD-2026-8239","enisaUuid":"9b05ec70-e5f9-3e11-8b06-c19ffd8ff6e1","description":"systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.","datePublished":"Feb 19, 2026, 7:48:55 PM","dateUpdated":"Jul 15, 2026, 1:15:02 AM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5vv4-hvf7-2h46\nhttps://github.com/sebhildebrandt/systeminformation/commit/b67d3715eec881038ccbaace2f2711419ac3e107\n","aliases":"CVE-2026-26318\nGHSA-5vv4-hvf7-2h46\n","assigner":"GitHub_M","epss":1.28,"enisaIdProduct":[{"id":"b3ab3685-265c-3842-beea-aff339d6a00a","product":{"name":"systeminformation","vendor":{"name":"sebhildebrandt"}},"product_version":"\u003c 5.31.0"}],"enisaIdVendor":[{"id":"ec3bdb88-983b-3787-96a3-9d3573e48f6f","vendor":{"name":"sebhildebrandt"}}],"enisaIdVulnerability":[{"id":"a6e68523-add4-33fc-9689-a24edbd54f73","vulnerability":{"id":"CVE-2026-26318","description":"systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.","datePublished":"Feb 19, 2026, 7:48:55 PM","dateUpdated":"Jul 15, 2026, 1:15:02 AM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5vv4-hvf7-2h46\nhttps://github.com/sebhildebrandt/systeminformation/commit/b67d3715eec881038ccbaace2f2711419ac3e107\n","enisa_id":"EUVD-2026-8239\n","assigner":"GitHub_M","epss":1.28,"dataProcessed":"Oct 27, 2026, 7:20:03 AM","vulnerabilityProduct":[{"id":"0b7477ef-6692-3a56-8b17-12c1404423e7","product":{"name":"systeminformation","vendor":{"name":"sebhildebrandt"}},"product_version":"\u003c 5.31.0"}],"vulnerabilityVendor":[{"id":"4e3d8ad6-ec77-3fda-9768-fcc40c5c0488","vendor":{"name":"sebhildebrandt"}}]}},{"id":"b77e8950-65f9-3a36-a059-521b2525837d","vulnerability":{"id":"GHSA-5vv4-hvf7-2h46","description":"Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation","datePublished":"Feb 18, 2026, 10:36:50 PM","dateUpdated":"Sep 24, 2026, 2:41:15 PM","baseScore":0.0,"references":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5vv4-hvf7-2h46\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-26318\nhttps://github.com/sebhildebrandt/systeminformation/commit/b67d3715eec881038ccbaace2f2711419ac3e107\nhttps://access.redhat.com/security/cve/CVE-2026-26318\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2441124\nhttps://github.com/sebhildebrandt/systeminformation\nhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26318.json\n","enisa_id":"EUVD-2026-8239\n","aliases":"GHSA-5vv4-hvf7-2h46\nCVE-2026-26318\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:53:52 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}