Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-50289: systeminformation library may execute arbitrary commands on Linux
CVE-2026-50289 · published 3 months ago
Summary
The Node.js systeminformation package used to gather OS details can run any shell command when its networkInterfaces() function reads a specially crafted source line in /etc/network/interfaces on Debian or Ubuntu systems. This could let an attacker run code whenever the function is called. Upgrade to version 5.31.7 or later to stop the problem.
What to do
- Update plusinnovations systeminformation to version 5.31.7.
- Update debian node-systeminformation to version 5.31.7-1.
- Update systeminformation to version 5.23.8-aikido.6.
- Update rootio @rootio/systeminformation to version 5.23.8-root.io.6.
- Update systeminformation systeminformation to version 5.31.7 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | plusinnovations | systeminformation |
<= 5.31.6 < 5.31.7 Fix: upgrade to 5.31.7
|
| – | sebhildebrandt | systeminformation | < 5.31.7 |
| Debian:14 | debian | node-systeminformation |
< 5.31.7-1 Fix: upgrade to 5.31.7-1
|
| – | systeminformation | systeminformation |
< 5.31.7 cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:* |
| Root:npm | – | systeminformation |
< 5.23.8-aikido.6 Fix: upgrade to 5.23.8-aikido.6
|
| Root:npm | rootio | @rootio/systeminformation |
< 5.23.8-root.io.6 Fix: upgrade to 5.23.8-root.io.6
|
| Ubuntu:26.10 | canonical | node-systeminformation | All versions |
Original advisory text
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.
References
- https://github.com/advisories/GHSA-5xpp-75jx-m839
- https://security-tracker.debian.org/tracker/CVE-2026-50289 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50289... Vendor Advisory
- https://github.com/sebhildebrandt/systeminformation Product
- https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.31.7 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-50289 Vendor Advisory
- https://github.com/sebhildebrandt/systeminformation/commit/bbfddde48672d0ee124fe... Patch
- https://ubuntu.com/security/CVE-2026-50289 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-50289 Third Party Advisory
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xp... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published17 Jul 2026
Updated7 Nov 2026
First seen16 Jul 2026
Sources
DEBIAN-CVE-2026-50289 · OSV
GHSA-5xpp-75jx-m839 · GHSA
CVE-2026-50289 · NVD
GHSA-5xpp-75jx-m839 · OSV
CVE-2026-50289 · MITRE
CVE-2026-50289 · OSV
UBUNTU-CVE-2026-50289 · OSV
Track software like this
Free during beta