Read the docs
TI-2026-37031 Aliases CVE-2026-50289GHSA-5xpp-75jx-m839

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

Priority HIGH 73CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02184 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed systeminformation (sebhildebrandt): 5.31.7systeminformation (npm): 5.31.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sebhildebrandtsysteminformationbefore 5.31.75.31.7Patch availableCNA
—systeminformation (npm)before 5.31.75.31.7Patch availableGHSA-5xpp-75jx-m839
  • systeminformation Vendorsebhildebrandt Affected before 5.31.7 Fixed in 5.31.7 Patch available CNA
  • systeminformation (npm) Vendor— Affected before 5.31.7 Fixed in 5.31.7 Patch available GHSA-5xpp-75jx-m839

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*before 5.31.7Vulnerablesebhildebrandt
  • cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:* Versions before 5.31.7 Vulnerable ·sebhildebrandt

Remediation

  • Fix · CNA systeminformation (sebhildebrandt) Fixed in 5.31.7
  • Fix · GHSA-5xpp-75jx-m839 systeminformation (npm) Fixed in 5.31.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 6 products
  • Cryostat 4
  • Multicluster Engine for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Developer Hub 1
  • Red Hat OpenShift AI (RHOAI)
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50289
  2. 2026-10-03 Alias added: GHSA-5xpp-75jx-m839
  3. 2026-10-24 Affected versions changed · Red Hat
  4. 2026-10-24 CVSS score added · Red Hat
  5. 2026-10-27 Affected versions changed · Red Hat
  6. 2026-11-04 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Other 2

  • TI-2021-04415 Command injection in sebhildebrandt systeminformation KEVCVSS 3.1HIGH 7.8
  • TI-2023-22901 systeminformation SSID Command Injection Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-41734 Command Injection in fsSize() on Windows CVSS 3.1HIGH 8.1
  • TI-2020-06270 Command injection in systeminformation CVSS 3.1HIGH 8.8
  • TI-2021-04487 Command Injection Vulnerability in systeminformation CVSS 3.1CRITICAL 9.8
  • TI-2020-16066 Prototype Pollution leading to Command Injection in systeminformation CVSS 3.1CRITICAL 9.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences