From 22242aa56188f2bffcbd7d265a11e1ebb808b460 Mon Sep 17 00:00:00 2001 From: Sebastian Hildebrandt Date: Sat, 14 Feb 2026 11:09:05 +0100 Subject: [PATCH] wifiNetworks() fixed CWE-78 command injection issue (linux) --- CHANGELOG.md | 1 + README.md | 2 +- docs/history.html | 6 ++++++ docs/index.html | 6 +++--- docs/security.html | 16 +++++++++++++++- lib/wifi.js | 4 ++-- 6 files changed, 28 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 90f6eb6..49c277d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -90,6 +90,7 @@ For major (breaking) changes - **version 4, 3 and 2** - see end of page. | Version | Date | Comment | | ------- | ---------- | --------------------------------------------------------------------------------------------------- | +| 5.30.8 | 2026-02-14 | `wifiNetworks()` fixed CWE-78 command injection issue (linux) | | 5.30.7 | 2026-01-31 | `networkInterfaces()` fixed getWindowsIEEE8021x issue (windows) | | 5.30.6 | 2026-01-22 | `graphics()` improved nvidia-smi detection (windows) | | 5.30.5 | 2026-01-16 | `networkInterfaces()` fix uppercase iface names (linux) | diff --git a/README.md b/README.md index 03151f4..3c46c59 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ ## The Systeminformation Project This is amazing. Started as a small project just for myself, it now has > 19,000 -lines of code, > 700 versions published, up to 15 mio downloads per month, > 450 +lines of code, > 700 versions published, up to 20 mio downloads per month, > 480 mio downloads overall. Top 10 NPM ranking for backend packages. Thank you to all who contributed to this project! diff --git a/docs/history.html b/docs/history.html index b09689e..a17d5c3 100644 --- a/docs/history.html +++ b/docs/history.html @@ -57,6 +57,12 @@ + + 5.30.8 + + 2026-02-14 + wifiNetworks() fixed CWE-78 command injection issue (linux) + 5.30.7 diff --git a/docs/index.html b/docs/index.html index 0546942..5fe6ee6 100644 --- a/docs/index.html +++ b/docs/index.html @@ -166,11 +166,11 @@
- Security advisory:
Update to v5.27.14 + Security advisory:
Update to v5.30.8
systeminformation
 
-
New Version: 5.30.7
+
New Version: 5.30.8
@@ -212,7 +212,7 @@
Downloads last month
-
957
+
969
Dependents
diff --git a/docs/security.html b/docs/security.html index 85feb74..30e7a22 100644 --- a/docs/security.html +++ b/docs/security.html @@ -44,6 +44,21 @@
Security Advisories
+

wifiNetworks Command Injection Vulnerability

+

Affected versions: + < 5.30.8
+ Date: 2026-02-14
+ CVE indentifier ... +

+ +

Impact

+

We had an issue that there was a possibility to perform a potential command injection possibility by manipulating SSIDs in wifiNetworks() on linux machines.

+ +

Patch

+

Problem was fixed with parameter checking. If you are using version 5, please upgrade to version >= 5.30.8.

+
+
+

fsSize Command Injection Vulnerability

Affected versions: < 5.27.14
@@ -58,7 +73,6 @@

Problem was fixed with parameter checking. If you are using version 5, please upgrade to version >= 5.27.14.


-

SSID Command Injection Vulnerability

Affected versions: < 5.23.7
diff --git a/lib/wifi.js b/lib/wifi.js index 0fd3a60..4920fe8 100644 --- a/lib/wifi.js +++ b/lib/wifi.js @@ -437,8 +437,8 @@ function wifiNetworks(callback) { const res = getWifiNetworkListIw(ifaceSanitized); if (res === -1) { // try again after 4 secs - setTimeout((iface) => { - const res = getWifiNetworkListIw(iface); + setTimeout(() => { + const res = getWifiNetworkListIw(ifaceSanitized); if (res !== -1) { result = res; }