CVE-2026-50289 Details
Description
systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.
A command injection vulnerability has been identified in the systeminformation library for Node.js, specifically in the networkInterfaces() function on Linux. This issue, present in versions prior to 5.31.7, arises from the way the library handles the Debian/Ubuntu interfaces(5) source directive. The function reads the /etc/network/interfaces file, extracts source path tokens, and interpolates them unquoted into a shell command executed by execSync. This allows paths containing shell metacharacters to execute arbitrary commands in any process that calls networkInterfaces(), including through the library's getStaticData() and getAllData() functions. The vulnerability is rooted in unsanitized input from local system files, which can be exploited by manipulating the interfaces file to include malicious commands.
Users should upgrade to version 5.31.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xpp-75jx-m839 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/sebhildebrandt/systeminformation/commit/bbfddde48672d0ee124fefdb3cb4442fd9dd4f03 | [email protected] | Patch |
| https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.31.7 | [email protected] | ProductRelease Notes |
| https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xpp-75jx-m839 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| systeminformation systeminformation | < 5.31.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |