# CVE-2026-44724: sebhildebrandt systeminformation command injection in networkInterfaces

Source: https://junglewise.ai/threats/cve-2026-44724-sebhildebrandt-systeminformation-command-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44724 · Severity: high · CVSS 7.8 · Published 2026-05-27

The systeminformation library, a popular Node.js package for retrieving system hardware and software details, is vulnerable to command injection on Linux systems. An attacker with the ability to modify local NetworkManager connection profiles can embed malicious commands that are automatically executed with the privileges of any application using this library. This could lead to full system compromise or unauthorized data access if the monitoring or inventory software using the library runs with elevated permissions.

Technologies: [systeminformation (npm)](https://junglewise.ai/threats/technologies/systeminformation). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-44724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44724 being exploited in the wild.

**How severe is CVE-2026-44724?** High severity, with a CVSS score of 7.8, published 27 May 2026.

**Which products and versions are affected?** systeminformation (npm) >= 4.17.0, <= 5.31.5, SEMVER:introduced=4.17.0,fixed=5.31.6.

**Is there a fix for CVE-2026-44724?** Yes. systeminformation (npm): upgrade to 5.31.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44724 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44724?** Check whether you run systeminformation (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- systeminformation (npm): upgrade to 5.31.6 or later

  ```sh
  npm install systeminformation@5.31.6
  ```


## Technical details

A command injection vulnerability exists in `lib/network.js` within the `networkInterfaces()` function. The library retrieves active NetworkManager connection names via `nmcli device status` but fails to sanitize these names before interpolating them into subsequent shell commands executed via `execSync()`. Specifically, the `connectionName` variable is used in three sinks involving `nmcli connection show`. An attacker who can create or rename a NetworkManager profile (e.g., via local access or a separate vulnerability) can inject shell metacharacters like `$()` or `;` to execute arbitrary code with the privileges of the Node.js process. The fix involves migrating from shell-based `execSync` strings to `execFileSync` or `spawnSync` using argument arrays to prevent shell interpolation.

## Affected products

- sebhildebrandt systeminformation >= 4.17.0, <= 5.31.5

## Identifiers

- CVE-2026-44724
- GHSA-hvx9-hwr7-wjj9

## Timeline

- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-13: disclosed: CVE-2026-44724 assigned
- 2026-05-07: patched: Fixed in version 5.31.6

## References

- [https://api.github.com/users/thesmartshadow](https://api.github.com/users/thesmartshadow)
- [https://github.com/thesmartshadow](https://github.com/thesmartshadow)
- [https://api.github.com/users/thesmartshadow/gists%7B/gist_id%7D](https://api.github.com/users/thesmartshadow/gists%7B/gist_id%7D)
- [https://api.github.com/users/thesmartshadow/repos](https://api.github.com/users/thesmartshadow/repos)
- [https://avatars.githubusercontent.com/u/33183887?v=4](https://avatars.githubusercontent.com/u/33183887?v=4)
- [https://api.github.com/users/thesmartshadow/events%7B/privacy%7D](https://api.github.com/users/thesmartshadow/events%7B/privacy%7D)

## Related threats

- [systeminformation prototype pollution in networkStats](https://junglewise.ai/threats/cve-2026-116674-systeminformation-is-a-system-and-os-information-library-for)
- [systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net](https://junglewise.ai/threats/cve-2026-116673-systeminformation-is-a-system-and-os-information-library-for)
- [systeminformation PowerShell command injection via Unicode quotation marks](https://junglewise.ai/threats/cve-2026-116576-systeminformation-is-a-system-and-os-information-library-for)
- [sebhildebrandt systeminformation OS command injection in networkInterfaces](https://junglewise.ai/threats/cve-2026-50289-sebhildebrandt-systeminformation-os-command-injection-in)
- [sebhildebrandt systeminformation command injection in versions function](https://junglewise.ai/threats/cve-2026-26318-sebhildebrandt-systeminformation-command-injection-in-versions)