CVE-2026-50289

Katalog CVE

CVSS 8.8 · High EPSS 3,6%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada systeminformation. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

29 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

3,6% peluang dieksploitasi; lebih tinggi dari 89,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xpp-75jx-m839 exploit · mitigasi · advisory vendor
• https://github.com/sebhildebrandt/systeminformation/commit/bbfddde48672d0ee124fefdb3cb4442fd9dd4f03 patch
• https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.31.7 product · release notes