Vulnerability · Published Jul 17, 2026 · Assigned by GitHub_M

CVE-2026-50289systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

High 8.7

In plain English

A high-severity OS command injection in systeminformation from sebhildebrandt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)2.2%top 17.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	node-systeminformation	5.31.7-1	DEBIAN-CVE-2026-50289
Ubuntu:26.10	node-systeminformation	no fix listed	UBUNTU-CVE-2026-50289
npm	systeminformation	5.31.7	GHSA-5xpp-75jx-m839

Affected products (as reported)

Vendor	Product	Versions
sebhildebrandt	systeminformation	< 5.31.7

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xpp-75jx-m839 x_refsource_CONFIRM
https://github.com/sebhildebrandt/systeminformation/commit/bbfddde48672d0ee124fefdb3cb4442fd9dd4f03 x_refsource_MISC
https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.31.7 x_refsource_MISC