Executive brief
The systeminformation library, a popular Node.js package for retrieving system hardware and software details, is vulnerable to command injection on Linux systems. An attacker with the ability to modify local NetworkManager connection profiles can embed malicious commands that are automatically executed with the privileges of any application using this library. This could lead to full system compromise or unauthorized data access if the monitoring or inventory software using the library runs with elevated permissions.
Technical details
A command injection vulnerability exists in `lib/network.js` within the `networkInterfaces()` function. The library retrieves active NetworkManager connection names via `nmcli device status` but fails to sanitize these names before interpolating them into subsequent shell commands executed via `execSync()`. Specifically, the `connectionName` variable is used in three sinks involving `nmcli connection show`. An attacker who can create or rename a NetworkManager profile (e.g., via local access or a separate vulnerability) can inject shell metacharacters like `$()` or `;` to execute arbitrary code with the privileges of the Node.js process. The fix involves migrating from shell-based `execSync` strings to `execFileSync` or `spawnSync` using argument arrays to prevent shell interpolation.
Affected products
- sebhildebrandt systeminformation >= 4.17.0, <= 5.31.5
Timeline
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-13: disclosed: CVE-2026-44724 assigned
- 2026-05-07: patched: Fixed in version 5.31.6
References
- https://api.github.com/users/thesmartshadow
- https://github.com/thesmartshadow
- https://api.github.com/users/thesmartshadow/gists%7B/gist_id%7D
- https://api.github.com/users/thesmartshadow/repos
- https://avatars.githubusercontent.com/u/33183887?v=4
- https://api.github.com/users/thesmartshadow/events%7B/privacy%7D