CVE-2026-26318 is an OS command injection vulnerability (CWE-78) in the systeminformation Node.js library maintained by sebhildebrandt. The issue arises from improper neutralization of special elements in the output of the locate command used within the versions() function. Versions before 5.31.0 are affected. The vulnerability allows an attacker with local privileges to execute arbitrary OS commands, potentially leading to complete compromise of confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. The issue is fixed in version 5.31.0.

Successful exploitation of this vulnerability can lead to arbitrary OS command execution with the privileges of the user running the Node.js application. This can result in full system compromise including unauthorized data access, modification, or denial of service. The CVSS vector indicates local attack vector with low attack complexity, requiring low privileges and no user interaction, with complete impact on confidentiality, integrity, and availability.

Upgrade systeminformation to version 5.31.0 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds in the vendor advisory. Users should apply the official fix to remediate this issue.