Skip to content

Menu
  • Home
Menu

CVE-2026-26318 – systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`

Posted on February 19, 2026
CVE ID : CVE-2026-26318

Published : Feb. 19, 2026, 8:25 p.m. | 1 hour, 37 minutes ago

Description : systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Post Views: 9

Site map

  • About Us
  • Privacy Policy
  • Terms & Conditions of Use
©2026 | Design: Newspaperly WordPress Theme