OS command injection in the `systeminformation` npm package (CVE-2026-50289)

CVE-2026-50289 is an OS command injection vulnerability in the `systeminformation` npm package affecting the `networkInterfaces()` function on Linux. The `checkLinuxDCHPInterfaces()` function reads `/etc/network/interfaces` and interpolates `source` directive paths parsed from file content directly into a shell command string passed to `execSync()` without sanitization or quoting, allowing shell metacharacters in a sourced path to break out of the intended pipeline. Any actor who can write a file reachable through the `source` chain achieves arbitrary command execution with the privileges of the calling Node.js process; if that process runs with elevated privileges, the injected command inherits those privileges. Public POC available. Affected versions: - <= 5.31.6 We recommend updating to: 5.31.7. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xpp-75jx-m839 Details: https://vuln.today/cve/CVE-2026-50289