PatchSiren has analyzed CVE-2026-50289, a HIGH severity vulnerability in the systeminformation library for node.js. The vulnerability is caused by a command injection issue in the networkInterfaces() function on Linux systems, which can be exploited by a local attacker to execute arbitrary commands. This vulnerability affects users of the systeminformation library, particularly those using versions prior [truncated]
CVE-2026-44724 is a command injection vulnerability in the systeminformation Node.js library affecting versions 4.17.0 through 5.31.5 on Linux systems. The vulnerability exists in the networkInterfaces() function, where an unsanitized NetworkManager connection profile name—obtained from nmcli device status output—is interpolated into shell command strings executed via execSync(). While the library sanitiz [truncated]
The systeminformation library for Node.js, prior to version 5.30.8, contains a command injection vulnerability in the `wifiNetworks()` function. This vulnerability allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. The `wifiNetworks()` function in `lib/wifi.js` initially sanitizes the `iface` parameter but fails to do so in the retry [truncated]
