{"answers":{"affected":"2 open source packages ship an affected version, including systeminformation.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44724 exists.","fix":"Upgrade systeminformation to 5.31.6 or later.","what":"CVE-2026-44724 is a high-severity command injection vulnerability in sebhildebrandt systeminformation, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-44724 and fix it if it is affected.\n\nWhat it is: CVE-2026-44724 is a high-severity command injection vulnerability in sebhildebrandt systeminformation, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44724 exists.\n\nAffected packages and fixed versions:\n- systeminformation (npm): affected from 4.17.0; fixed in 5.31.6\n- systeminformation (npm): affected from 4.17.0; fixed in 5.31.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-44724/ (Markdown: https://insights.sbomify.com/CVE-2026-44724/index.md)","id":"CVE-2026-44724","markdown":"https://insights.sbomify.com/CVE-2026-44724/index.md","name":"CVE-2026-44724","record":{"aliases":["CLEANSTART-2026-LZ10003","DEBIAN-CVE-2026-44724","ECHO-dbb1-ea8a-bf8a","GHSA-hvx9-hwr7-wjj9","MINI-2xpp-hjx9-jm5j","MINI-4vqc-v35h-h86h","MINI-8gf3-92j8-cvg8","MINI-9m52-vqc5-62jq","MINI-f4rq-2r8p-mjvx","MINI-ff4q-78r9-jmrq","MINI-fpx2-95gm-374c","MINI-ghq7-pw6r-63ff","MINI-h254-qr3f-7q7f","MINI-p4ph-7g5g-9x6p","MINI-qcqr-jpf8-4qhh","ROOT-APP-NPM-CVE-2026-44724","UBUNTU-CVE-2026-44724"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Node.js system info library","requires_auth":"low_privilege","summary":"Attackers can execute arbitrary commands on Linux systems via unsanitized NetworkManager profile names in the systeminformation library.","user_interaction":"not_required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"description":"systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name","id":"CVE-2026-44724","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":2,"n_references":1,"next":{"headline":"EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution","id":"CVE-2026-44725"},"packages":[{"ecosystem":"npm","fixed":["5.31.6"],"introduced":["4.17.0"],"last_affected":[],"package":"systeminformation","purl":null,"source":"GHSA-hvx9-hwr7-wjj9"},{"ecosystem":"npm","fixed":["5.31.6"],"introduced":["4.17.0"],"last_affected":[],"package":"systeminformation","purl":"pkg:npm/systeminformation","source":"GHSA-hvx9-hwr7-wjj9"}],"prev":{"headline":"Command injection in vowpal wabbit","id":"CVE-2026-44723"},"products":["systeminformation"],"published":"2026-05-27","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-28","vendors":["sebhildebrandt"]},"summary":"Attackers can execute arbitrary commands on Linux systems via unsanitized NetworkManager profile names in the systeminformation library.","url":"https://insights.sbomify.com/CVE-2026-44724/"}