Read the docs
TI-2026-32611 Aliases CVE-2026-44724GHSA-hvx9-hwr7-wjj9

systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

Priority HIGH 69CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00915 60th percentileScored 2026-11-07
Fix Fixed systeminformation (sebhildebrandt): 5.31.6systeminformation (npm): 5.31.6Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sebhildebrandtsysteminformation4.17.0 to before 5.31.65.31.6Patch availableCNA
—systeminformation (npm)4.17.0 to before 5.31.65.31.6Patch availableGHSA-hvx9-hwr7-wjj9
  • systeminformation Vendorsebhildebrandt Affected 4.17.0 to before 5.31.6 Fixed in 5.31.6 Patch available CNA
  • systeminformation (npm) Vendor— Affected 4.17.0 to before 5.31.6 Fixed in 5.31.6 Patch available GHSA-hvx9-hwr7-wjj9

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:*:*:*——sebhildebrandt
  • cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:*:*:* Versions — — ·sebhildebrandt

Remediation

  • Fix · CNA systeminformation (sebhildebrandt) Fixed in 5.31.6
  • Fix · GHSA-hvx9-hwr7-wjj9 systeminformation (npm) Fixed in 5.31.6 Advisory →

Red Hat 3 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:33574 Released 2026-06-30 · Red Hat rating Important
    Red Hat Developer Hub 1.9.6 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1.9Fixed RHSA-2026:33574
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Not affected: 5 products
  • Cryostat 4
  • Multicluster Engine for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Developer Hub 1.9
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44724
  2. 2026-10-03 Alias added: GHSA-hvx9-hwr7-wjj9
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Affected versions changed · Red Hat

References

Advisory 1

Other 3

  • TI-2021-04415 Command injection in sebhildebrandt systeminformation KEVCVSS 3.1HIGH 7.8
  • TI-2026-37031 systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux CVSS 4.0HIGH 8.7
  • TI-2026-80585 Windows command injection in systeminformation services() CVSS 3.1HIGH 7.8
  • TI-2024-37295 Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation CVSS 3.1HIGH 7.8
  • TI-2026-81429 Prototype pollution in systeminformation networkStats() CVSS 3.1MEDIUM 6.5
  • TI-2023-22901 systeminformation SSID Command Injection Vulnerability CVSS 3.1CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences