CVE-2026-44724: systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

Synopsis

Command injection in the systeminformation Node.js library (versions 4.17.0 through 5.31.5) allows a local attacker with a low-privilege account to inject shell metacharacters via a crafted NetworkManager connection profile name, which is then interpolated unsanitized into shell commands executed through execSync(). The flaw is reachable locally and requires no user interaction once the malicious profile name is in place. Successful exploitation gives the attacker full read, write, and execution capability on the host, equivalent to remote code execution at the privilege level of the Node.js process. A patched-image rebuild at version 5.31.6 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or root credentials to trigger the injection.

• Victim interactionNot required

  No user action is needed once a malicious NetworkManager connection profile name is present on the system.

• Attack complexityDetail

  The exploit is reliable and condition-free once the crafted profile name exists; no race conditions or special memory layout are required.

Blast Radius

• An attacker can read arbitrary files accessible to the Node.js process, including application secrets, environment variables, and stored credentials.
• An attacker can write or overwrite files on the host, modifying application code, configuration, or persistent data.
• An attacker can execute arbitrary shell commands at the privilege level of the running Node.js process, enabling lateral movement or privilege escalation.
• The affected service can be crashed or made unavailable by injecting commands that terminate the process or exhaust host resources.