CVE-2026-50289: systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is v…
systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.
- Published by source
- 2026-07-17
- First seen by Reality Radar
- 2026-10-24
- Last verified
- 2026-10-24
Affected
- Manufacturer
- systeminformation
- Products
- systeminformation
- Versions
- <5.31.7
- CPE
- cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*
Whether your exact unit is affected depends on the model, serial number and region in the official notice.
What the official notice says
Risk: CVSS 8.8
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-07-17
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1585 | new | 2026-10-24 | 580ff296aac7…c9d529 | dfb01b0399a2…aacb3a |
Chain head: #1609 a9149670ca39…bb921c