{"id":"CVE-2026-50289","aliases":["GHSA-5xpp-75jx-m839"],"url":"https://o3.security/vulnerability/CVE-2026-50289","summary":"systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux","details":"systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.","published":"2026-07-17T19:42:41.417Z","modified":"2026-08-12T03:51:31.917310812Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"systeminformation","fixedVersion":"5.31.7"}],"fix":{"url":"https://github.com/sebhildebrandt/systeminformation/commit/bbfddde48672d0ee124fefdb3cb4442fd9dd4f03","label":"sebhildebrandt/systeminformation@bbfddde"},"references":[{"type":"WEB","url":"https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.31.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50289.json"},{"type":"ADVISORY","url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xpp-75jx-m839"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50289"},{"type":"FIX","url":"https://github.com/sebhildebrandt/systeminformation/commit/bbfddde48672d0ee124fefdb3cb4442fd9dd4f03"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:31.917310812Z"}}