PT-2026-40714 · Root+2 · @Rootio/Systeminformation+1

Thesmartshadow · Published 2026-05-13 · Updated 2026-05-27 · CVE-2026-44724

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions systeminformation versions 4.17.0 through 5.31.5

Description On Linux, the library is subject to command injection within the networkInterfaces() function. This occurs when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is retrieved internally from the output of the nmcli device status command. While the library sanitizes network interface names, it fails to apply the same sanitization to the parsed connectionName variable. This unsanitized variable is subsequently interpolated into three shell command strings executed via execSync(), allowing an attacker who can create or rename a NetworkManager connection profile to execute arbitrary shell commands with the privileges of the Node.js process.

Recommendations Update to version 5.31.6. As a temporary workaround, restrict the ability of users to create or rename NetworkManager connection profiles on affected Linux systems.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-44724

GHSA-HVX9-HWR7-WJJ9

Affected Products

@Rootio/Systeminformation

Systeminformation

References · 7

• 🔥 https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-hvx9-hwr7-wjj9 · Exploit
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44724 · Security Note
• https://osv.dev/vulnerability/GHSA-hvx9-hwr7-wjj9 · Vendor Advisory
• https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.31.6 · Note
• https://github.com/sebhildebrandt/systeminformation · Note
• https://t.me/CVEtracker/55156 · Telegram Post