Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection

Description

On Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters.

This is not caused by a caller passing attacker-controlled arguments into networkInterfaces().

Recommendation

Update the systeminformation package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.17.0, <= 5.31.5
• Patched version(s): 5.31.6

References

• GHSA-hvx9-hwr7-wjj9
• CVE-2026-44724
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path - CVE-2026-26280
• Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation - CVE-2026-26318
• @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input - CVE-2026-42853
• Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction - CVE-2026-31828

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

systeminformation