CVE catalog
CVE-2026-26318
DEBIAN-CVE-2026-26318
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 1.28% · Oct 25, 2026
systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | jupyterlab | 13 | 4.0.11+ds1+~cs11.25.27-7 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds1+~cs11.25.27-8 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds1+~cs11.25.27-9 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds2+~cs11.25.27-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds2+~cs11.25.27-3 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds3+~cs11.25.27-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds4+~cs11.25.27-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds4+~cs11.25.27-2 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds4+~cs11.25.27-3 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds4+~cs11.25.27-4 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.11+ds5+~cs11.25.27-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.0.13+ds1+~2.0.1+~cs1.4.4-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-2 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-3 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-4 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-5 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-6 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-7 | vulnerable |
| Debian | jupyterlab | 13 | 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8 | vulnerable |
| Debian | jupyterlab | 13 | 4.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1 | vulnerable |
| Debian | jupyterlab | 13 | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-2 | vulnerable |
| Debian | jupyterlab | 13 | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 | vulnerable |
| Debian | jupyterlab | 13 | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4 | vulnerable |
| Debian | jupyterlab | 13 | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-5 | vulnerable |
| Debian | jupyterlab | 13 | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-6 | vulnerable |
| Debian | jupyterlab | 13 | 4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds1+~cs11.25.27-7 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds1+~cs11.25.27-8 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds1+~cs11.25.27-9 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds2+~cs11.25.27-1 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds2+~cs11.25.27-3 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds3+~cs11.25.27-1 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds4+~cs11.25.27-1 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds4+~cs11.25.27-2 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds4+~cs11.25.27-3 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds4+~cs11.25.27-4 | vulnerable |
| Debian | jupyterlab | 14 | 4.0.11+ds5+~cs11.25.27-1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | jupyterlab | deb | 14 | 4.0.11+ds5+~cs11.25.27-1 | Not reported | DEBIAN-CVE-2026-26318 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [jupyterlab]Affected
Details (2)
4.0.11+ds1+~cs11.25.27-7· all · trixieAffected
pypi · jupyterlab · debian · 13
4.0.11+ds1+~cs11.25.27-7· all · trixieAffected
pypi · jupyterlab · debian · 13
Observed: