Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-44724systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

High 7.8

In plain English

A high-severity OS command injection in systeminformation from sebhildebrandt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.9%top 39.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	jupyterlab	no fix listed	DEBIAN-CVE-2026-44724
Debian:14	jupyterlab	4.0.11+ds5+~cs11.25.27-1	DEBIAN-CVE-2026-44724
Ubuntu:25.10	jupyterlab	no fix listed	UBUNTU-CVE-2026-44724
Ubuntu:26.04:LTS	jupyterlab	no fix listed	UBUNTU-CVE-2026-44724
Ubuntu:26.10	jupyterlab	no fix listed	UBUNTU-CVE-2026-44724
Ubuntu:26.10	node-systeminformation	no fix listed	UBUNTU-CVE-2026-44724
npm	systeminformation	5.31.6	GHSA-hvx9-hwr7-wjj9

Affected products (as reported)

Vendor	Product	Versions
sebhildebrandt	systeminformation	>= 4.17.0, < 5.31.6

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-hvx9-hwr7-wjj9 x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2026-44724 vdb-entry, x_refsource_REDHAT
RHBZ#2482416 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44724.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:33574 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisory, x_refsource_REDHAT