Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-50289

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.011
EPSS Ranking 62.7%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-50289


Contact Us

Shodan ® - All rights reserved