Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Date: 2026-05
Affected: npm/systeminformation
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44724
CWE: CWE-78
CVSS: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

## Summary On Linux, `systeminformation` is vulnerable to command injection in `networkInterfaces()` when an **active NetworkManager connection profile name** contains shell metacharacters. This is not caused by a caller passing attacker-controlled arguments into `networkInterfaces()`. The vulnerable value is obtained internally from real `nmcli device status` output. The library sanitizes the network interface name before using it in shell commands, but it does **not** apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized `connectionName` is then interpolated into three shell command strings executed through `execSync()`. This issue was validated locally against **real NetworkManager** and **real `nmcli`**. Calling only: ```js require('./lib').networkInterfaces() ``` was enough to trigger execution. The injected command ran with the privileges of the calling Node.js process. ## Affected Component & Versions **Affected component:** - [`lib/network.js`](https://github.com/sebhildebrandt/systeminformation/blob/ed1cac537c59763301d802ad1b55b4b8581e7553/lib/network.js) - `networkInterfaces()` - Linux NetworkManager / `nmcli` handling ## Impact & Threat Model **Confirmed impact:** An attacker who can create or rename an **active NetworkManager connection profile** can execute arbitrary shell commands when a Node.js process using `systeminformation` calls `networkInterfaces()`. **Confirmed realistic affected deployments inc


Mitigations:

Architectural layers (MAESTRO):