CVE-2026-44724 Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Attackers can execute arbitrary commands on Linux systems via unsanitized NetworkManager profile names in the systeminformation library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44724?
CVE-2026-44724 is a high-severity command injection vulnerability in sebhildebrandt systeminformation, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.
Weakness: CWE-78
Which versions are affected by CVE-2026-44724?
2 open source packages ship an affected version, including systeminformation.
| Package | Affected | Fixed in |
|---|---|---|
systeminformation npm | From 4.17.0 | 5.31.6 |
systeminformation npm | From 4.17.0 | 5.31.6 |
How do I fix CVE-2026-44724?
Upgrade systeminformation to 5.31.6 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-44724 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44724 exists.
Sources
Also known as CLEANSTART-2026-LZ10003, DEBIAN-CVE-2026-44724, ECHO-dbb1-ea8a-bf8a, GHSA-hvx9-hwr7-wjj9, MINI-2xpp-hjx9-jm5j, MINI-4vqc-v35h-h86h and 11 more.