CVE-2026-50289: systeminformation OS Command Injection RCE

CVE-2026-50289 Overview

CVE-2026-50289 is an OS command injection vulnerability [CWE-78] in the systeminformation Node.js library affecting versions prior to 5.31.7. The flaw resides in the checkLinuxDCHPInterfaces() function within lib/network.js. On Debian and Ubuntu systems, the library reads /etc/network/interfaces and interpolates a source <path> token unquoted into a shell command executed via execSync. Any process calling networkInterfaces(), getStaticData(), or getAllData() can execute attacker-controlled shell commands if the interfaces file contains shell metacharacters. The maintainer released a fix in version 5.31.7.

Critical Impact
Attackers who can influence /etc/network/interfaces content can achieve arbitrary command execution in any Node.js application invoking systeminformation network APIs on Linux.

Affected Products

systeminformation npm package versions prior to 5.31.7
Node.js applications running on Debian or Ubuntu Linux using the affected library
Server, container, and CLI workloads that call networkInterfaces(), getStaticData(), or getAllData()

Discovery Timeline

2026-07-17 - CVE-2026-50289 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-50289

Vulnerability Analysis

The systeminformation library provides system and OS information to Node.js applications. On Linux, the networkInterfaces() function inspects DHCP configuration by parsing /etc/network/interfaces. When the file contains a source directive referencing another configuration file, the library builds a shell command string that includes the referenced path without quoting or sanitization.

The unsanitized path is concatenated into cat ${file} 2> /dev/null | grep 'iface\|source' and executed by execSync(cmd, util.execOptsLinux). Shell metacharacters such as backticks, $(), or ; in the path token are interpreted by the shell, resulting in arbitrary command execution under the privileges of the Node.js process.

The vulnerability class is OS Command Injection tracked under [CWE-78]. Exploitation propagates through getStaticData() and getAllData(), both of which internally invoke networkInterfaces().

Root Cause

The root cause is unsafe string interpolation of file content into a shell command executed with execSync. The library trusts the format of /etc/network/interfaces and does not validate or escape the source <path> token before passing it to a shell.

Attack Vector

An attacker who can write to /etc/network/interfaces, or trick an administrator into loading a crafted interfaces file, can plant a malicious source directive. When any process invokes networkInterfaces(), getStaticData(), or getAllData(), the injected command executes in the shell context of that process. In multi-tenant environments, container build pipelines, or monitoring agents running with elevated privileges, this can enable privilege escalation or lateral movement.

text

// Patch reference from docs/history.html
<tr>
  <th scope="row">5.31.7</th>
  <td>2026-05-29</td>
  <td><span class="code">networkInterfaces()</span> fix unsanitized command (linux)</td>
</tr>

Source: GitHub Commit bbfddde

Detection Methods for CVE-2026-50289

Indicators of Compromise

Unexpected child processes spawned by Node.js applications, particularly sh -c invocations containing cat /etc/network/interfaces
Modifications to /etc/network/interfaces introducing source directives with shell metacharacters such as backticks, $(), ;, |, or &
Outbound network connections initiated by short-lived shell processes launched from Node.js runtimes

Detection Strategies

Inventory Node.js dependencies for systeminformation versions below 5.31.7 using software composition analysis tooling
Alert on process lineage where node spawns /bin/sh executing commands that reference /etc/network/interfaces
Behavioral AI in Singularity Endpoint can flag anomalous shell child processes launched from Node.js runtimes on Linux hosts and reconstruct the full execution chain with Storyline technology

Monitoring Recommendations

Enable file integrity monitoring on /etc/network/interfaces and related configuration files under /etc/network/
Log and review execve events on Linux endpoints using auditd or eBPF-based sensors to catch shell metacharacter payloads
Correlate Node.js process telemetry with network egress to detect data exfiltration attempts following exploitation

How to Mitigate CVE-2026-50289

Immediate Actions Required

Upgrade systeminformation to version 5.31.7 or later across all Node.js projects and container images
Audit /etc/network/interfaces on Debian and Ubuntu hosts for suspicious source directives containing shell metacharacters
Rotate secrets accessible to any Node.js process that invoked networkInterfaces(), getStaticData(), or getAllData() on a suspect host

Patch Information

The maintainer released the fix in version 5.31.7 on 2026-05-29. Details are documented in the GitHub Security Advisory GHSA-5xpp-75jx-m839 and the v5.31.7 Release Notes. The corresponding source change is available in commit bbfddde.

Workarounds

Restrict write permissions on /etc/network/interfaces to root only and monitor for unauthorized changes
Avoid calling networkInterfaces(), getStaticData(), or getAllData() on Debian or Ubuntu until the upgrade is applied
Run Node.js services under least-privilege service accounts with restricted shell access to limit blast radius

bash

# Upgrade systeminformation to the patched version
npm install systeminformation@5.31.7 --save

# Verify installed version
npm ls systeminformation

# Audit interfaces file for suspicious source directives
grep -n '^source' /etc/network/interfaces