CVE-2026-50289

Summary On Linux, systeminformation's networkInterfaces() is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive. While collecting per-interface DHCP state, the library reads /etc/network/interfaces and, for every source <path> line it encounters, extracts the path token *from the file content* and interpolates it unquoted into a shell command string that is run via execSync(). A source line whose path contains shell metacharacters executes arbitrary commands with the privileges of the calling Node.js process. This is the same root-cause class as the previously-fixed NetworkManager-connection-name injection in this file: a value parsed out of local system state is re-interpolated into a shell command string without sanitization. The NetworkManager paths were converted to argument-array execution, but the interfaces(5) source-recursion sink in checkLinuxDCHPInterfaces() was left unfixed and still builds a shell string. The input to this sink is *unsanitized* (unlike the iface/connectionName paths, which pass through util.sanitizeString in strict mode before reaching their commands). Impact An attacker who can place or influence a sourced path in /etc/network/interfaces (or any file it transitively sources) achieves command execution inside any process that calls networkInterfaces(). Realistic affected deployments are the same ones that motivate this library: - local inventory / asset agents - monitoring and diagnostics agents - admin-dashboard backends collecting host information - device-management / desktop agents If such a process runs with elevated privileges, the injected command runs with those privileges. networkInterfaces() is a core, frequently-called API and is reached transitively by getStaticData() / getAllData(), so the sink is exercised by ordinary usage on Linux. Threat model The dangerous value is not a function argument supplied by the caller. It is read from the *content* of an interfaces(5) configurat

[![CVE-2026-50289 status](https://www.csirts.com/badge/CVE-2026-50289)](https://www.csirts.com/cve/CVE-2026-50289)