CVE-2026-44724: sebhildebrandt systeminformation command injection in networkInterfaces

CVE-2026-44724 · Severity: high · CVSS 7.8 · Published 2026-05-27

The systeminformation library, a popular Node.js package for retrieving system hardware and software details, is vulnerable to command injection on Linux systems. An attacker with the ability to modify local NetworkManager connection profiles can embed malicious commands that are automatically executed with the privileges of any application using this library. This could lead to full system compromise or unauthorized data access if the monitoring or inventory software using the library runs with elevated permissions.

Technologies: systeminformation (npm). Vendors: npm.

Quick answers

Is CVE-2026-44724 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44724 being exploited in the wild.
How severe is CVE-2026-44724?
High severity, with a CVSS score of 7.8, published 27 May 2026.
Which products and versions are affected?
systeminformation (npm) >= 4.17.0, <= 5.31.5, SEMVER:introduced=4.17.0,fixed=5.31.6.
Is there a fix for CVE-2026-44724?
Yes. systeminformation (npm): upgrade to 5.31.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44724 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-44724?
Check whether you run systeminformation (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • systeminformation (npm): upgrade to 5.31.6 or later
    npm install systeminformation@5.31.6

Technical details

A command injection vulnerability exists in `lib/network.js` within the `networkInterfaces()` function. The library retrieves active NetworkManager connection names via `nmcli device status` but fails to sanitize these names before interpolating them into subsequent shell commands executed via `execSync()`. Specifically, the `connectionName` variable is used in three sinks involving `nmcli connection show`. An attacker who can create or rename a NetworkManager profile (e.g., via local access or a separate vulnerability) can inject shell metacharacters like `$()` or `;` to execute arbitrary code with the privileges of the Node.js process. The fix involves migrating from shell-based `execSync` strings to `execFileSync` or `spawnSync` using argument arrays to prevent shell interpolation.

Affected products

  • sebhildebrandt systeminformation >= 4.17.0, <= 5.31.5

Identifiers

  • CVE-2026-44724
  • GHSA-hvx9-hwr7-wjj9

Timeline

  • 2026-05-07: advisory: GitHub Advisory published
  • 2026-05-13: disclosed: CVE-2026-44724 assigned
  • 2026-05-07: patched: Fixed in version 5.31.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.