High 7.8Published May 27, 2026

CVE-2026-44724systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

Updated under an hour ago (Oct 26, 2026, 7:40 PM ET)

Does this affect you?

It affects sebhildebrandt systeminformation and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for sebhildebrandt systeminformation

Exploited in the last 30 days

systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Aug 28, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

sebhildebrandt systeminformation sebhildebrandt:systeminformation (from the name)	from 4.17.0, < 5.31.6	CNA record
Red Hat Red Hat Developer Hub 1.9 redhat:rhdh	from 1782761244 not affected	CISA ADP
Red Hat Red Hat OpenShift AI 3.4 redhat:openshift_ai	from 1787250508 not affected	CISA ADP
Red Hat Cryostat 4 redhat:cryostat	4	CISA ADP
Red Hat Multicluster Engine for Kubernetes redhat:multicluster_engine	Versions not stated	CISA ADP
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 redhat:acm	2	CISA ADP

References

References

https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-hvx9-hwr7-wjj9	x-refsource-confirm
https://access.redhat.com/errata/RHSA-2026:33574
https://access.redhat.com/errata/RHSA-2026:60520
https://access.redhat.com/security/cve/CVE-2026-44724
https://bugzilla.redhat.com/show_bug.cgi?id=2482416
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44724.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.