CVE-2026-50289
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
The systeminformation library for Node.js before version 5.31.7 is vulnerable to OS command injection via the networkInterfaces() function on Linux. The issue stems from improper handling of the source directive in network configuration files, allowing arbitrary command execution.
Risk Assessment
An attacker can remotely execute arbitrary system commands in the process calling networkInterfaces(), potentially leading to full compromise of the application and server.
Recommendation
Update the systeminformation library to version 5.31.7 or later.
Other vulnerabilities in systeminformation
See all- CVE-2026-44724High
The systeminformation library for Node.js versions 4.17.0 to 5.31.5 is vulnerable to command injection in the networkInterfaces() function on Linux. This occurs when an active NetworkManager connection profile name contains shell metacharacters that are not properly sanitized before being used in shell commands.
- CVE-2026-26318High
The systeminformation library for Node.js prior to version 5.31.0 is vulnerable to command injection via unsanitized `locate` output in the `versions()` function. An attacker can exploit this flaw to execute arbitrary system commands.
- CVE-2026-26280High
The systeminformation library for Node.js contains a command injection vulnerability in the `wifiNetworks()` function. In the retry code path, the `iface` parameter is not sanitized, allowing an attacker to execute arbitrary OS commands.
Original NVD description (English source)
systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.