CVE-2026-50289 systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
Attackers can execute arbitrary OS commands via shell metacharacters in network interface configuration files when using the systeminformation library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50289?
CVE-2026-50289 is a high-severity command injection vulnerability in sebhildebrandt systeminformation, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.
Weakness: CWE-78
Which versions are affected by CVE-2026-50289?
2 open source packages ship an affected version, including systeminformation. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
systeminformation npm | All versions | 5.31.7 |
systeminformation npm | All versions | 5.31.7 |
Products include Systeminformation Systeminformation.
How do I fix CVE-2026-50289?
Upgrade systeminformation to 5.31.7 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-50289 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50289 exists.
Other vulnerabilities in sebhildebrandt systeminformation
- CVE-2023-42810 systeminformation SSID Command Injection Vulnerability
- CVE-2021-21388 Command Injection Vulnerability in systeminformation
- CVE-2026-26318 systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`
- CVE-2020-7752 Command Injection
- CVE-2026-26280 Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path
Sources
Also known as DEBIAN-CVE-2026-50289, ECHO-5e42-19f8-7f9b, GHSA-5xpp-75jx-m839, MINI-4g6g-mp3c-wp4q, MINI-c344-5wwm-82pf, MINI-g3w4-pprf-mwrq and 11 more.