systeminformation vulnerabilities

The systeminformation library for Node.js before version 5.31.7 is vulnerable to OS command injection via the networkInterfaces() function on Linux. The issue stems from improper handling of the source directive in network configuration files, allowing arbitrary command execution.

The systeminformation library for Node.js versions 4.17.0 to 5.31.5 is vulnerable to command injection in the networkInterfaces() function on Linux. This occurs when an active NetworkManager connection profile name contains shell metacharacters that are not properly sanitized before being used in shell commands.

The systeminformation library for Node.js prior to version 5.31.0 is vulnerable to command injection via unsanitized `locate` output in the `versions()` function. An attacker can exploit this flaw to execute arbitrary system commands.

The systeminformation library for Node.js contains a command injection vulnerability in the `wifiNetworks()` function. In the retry code path, the `iface` parameter is not sanitized, allowing an attacker to execute arbitrary OS commands.