CVE-2026-44724: systeminformation Command Injection Vulnerability in Linux NetworkManager Profiles
Summary
CVE-2026-44724: On Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. Affects systeminformation versions >= 4.17.0, < 5.31.6. Fixed in 5.31.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'systeminformation' package is a Node.js library that provides detailed information about the system, including hardware and network configurations. It is widely used in local inventory agents, monitoring tools, and diagnostics applications. This package interacts with Linux's NetworkManager to retrieve network interface details, making it essential for applications that require accurate network data.
Vulnerability Detail
The vulnerability arises from a command injection flaw in the 'networkInterfaces()' function of the 'systeminformation' package. When an active NetworkManager connection profile name contains shell metacharacters, it can lead to arbitrary command execution. The issue is due to the lack of sanitization for the connection profile name, which is extracted from the output of the 'nmcli device status' command. This unsanitized value is then interpolated into shell command strings executed via 'execSync()', allowing attackers to execute commands with the privileges of the calling Node.js process. The confirmed impact includes the ability for an attacker to execute arbitrary shell commands if they can manipulate the NetworkManager connection profile names.
How To Fix
Latest published version: 5.33.16 as of 22 Oct 2026
npm install systeminformation@5.33.16Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.31.6
This is the first release that contains the fix.
npm install systeminformation@5.31.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using connection profile names that contain shell metacharacters. Additionally, consider using argument-array execution methods like 'execFileSync()' instead of shell string interpolation for commands involving NetworkManager. For example:
const { execFileSync } = require('child_process');
const output = execFileSync(
'nmcli',
['connection', 'show', connectionName],
util.execOptsLinux
).toString();
Conclusion
The command injection vulnerability in the 'systeminformation' package poses a significant risk to applications that utilize NetworkManager on Linux. It is crucial to update to the patched version to mitigate this risk and ensure the security of your systems.
See every vulnerability recorded for systeminformation →
FAQ
CVE-2026-44724 is a command injection vulnerability in the 'systeminformation' package that allows attackers to execute arbitrary commands through unsanitized NetworkManager connection profile names.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your package-lock.json file without any signup.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
If immediate updates are not possible, ensure that your application does not use connection profile names with shell metacharacters as a temporary workaround.
More information can be found in the official GitHub advisory and the systeminformation package documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for systeminformation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
