The vulnerability arises from insufficient sanitization of the network interface parameter in the wifiNetworks function of the systeminformation library. When a scan returns empty, the retry path reuses the original unsanitized iface value and passes it directly into the execSync call that runs ‘iwlist {iface} scan’. An attacker controlling the iface argument can inject arbitrary OS commands, leading to full compromise of the Node.js process and, potentially, the host.

The issue affects the systeminformation package maintained by sebhildebrandt. Any Node.js application that imports this library and invokes wifiNetworks() with user‑supplied arguments, using a version earlier than 5.30.8, is vulnerable. The library version 5.30.8 and later contain the fix.

The severity score of 8.4 classifies this as high. Current exploitation potential is low (EPSS <1%) and the vulnerability is not in the CISA KEV catalog, but the attack vector requires that the application execute wifiNetworks() with a controllable interface name. If the attacker can supply such input, they can gain system execution rights with the privileges of the Node.js process. Therefore, the risk is significant if an application processes untrusted input.