CVE-2026-44724 Details
Description
systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.
A command injection vulnerability has been identified in the systeminformation library for Node.js, specifically in versions 4.17.0 through 5.31.5. The issue arises in the networkInterfaces() function when an active NetworkManager connection profile name contains shell metacharacters. The vulnerability is rooted in inconsistent sanitization of input; while the library properly sanitizes network interface names before they are used in shell commands, it fails to apply the same level of scrutiny to NetworkManager connection names, which can include harmful characters. This unsanitized data is then interpolated into command strings executed with execSync(), allowing for arbitrary command execution with the privileges of the Node.js process.
Users are advised to update to systeminformation version 5.31.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:33574 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:60520 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-44724 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2482416 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44724.json | redhat-SADP | |
| https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-hvx9-hwr7-wjj9 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-hvx9-hwr7-wjj9 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | redhat-SADP |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| systeminformation | >= 4.17.0, <= 5.31.5 (semver) |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 28, 2026 | CVE Modified | CISA-ADP |
| Aug 28, 2026 | CVE Modified | [email protected] |
| Aug 28, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 30, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |