GHSA-hvx9-hwr7-wjj9
High · 7.8CVSS
7.8
EPSS
—
Published
May 13, 2026
CISA due date
—
The record
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | systeminformation | 4.17.0 | 5.31.6 |
Related vulnerabilities
- CVE-2026-44724 systeminformation is a System and OS information library for node.js. Same vulnerability
- CVE-2026-26318 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- CVE-2026-26280 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- GHSA-5vv4-hvf7-2h46 Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation Also affects systeminformation
- GHSA-9c88-49p5-5ggf Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js… Also affects systeminformation
- GHSA-wphj-fx3q-84ch systeminformation has a Command Injection vulnerability in fsSize() function on Windows Also affects systeminformation
- CVE-2025-68154 systeminformation is a System and OS information library for node.js. Also affects systeminformation
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78