{"id":"CVE-2026-50289","title":"systeminformation: systeminformation: Arbitrary Command Execution via OS Command Injection (CVE-2026-50289)","summary":"A flaw was found in systeminformation, a Node.js library. A remote attacker can exploit an operating system (OS) command injection vulnerability in the `networkInterfaces()` function on Linux. This occurs because the library improperly han…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-78","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["openshift_ai_rhoai"],"patched":["systeminformation 5.31.7"],"published":"2026-07-17","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:27:26+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50289.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50289.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-50289"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501887"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50289"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50289"},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/bbfddde48672d0ee124fefdb3cb4442fd9dd4f03"},{"url":"https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.31.7"},{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xpp-75jx-m839"},{"url":"https://github.com/advisories/GHSA-5xpp-75jx-m839"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.03557,"epssPercentile":0.89262,"aliases":["GHSA-5xpp-75jx-m839"],"ecosystem":"npm","ingestedAt":"2026-07-15T23:47:19.056Z","slug":"CVE-2026-50289","body":"## Overview\n\nA flaw was found in systeminformation, a Node.js library. A remote attacker can exploit an operating system (OS) command injection vulnerability in the `networkInterfaces()` function on Linux. This occurs because the library improperly handles paths from `/etc/network/interfaces`, allowing an attacker to inject and execute arbitrary commands. This could lead to significant compromise of system confidentiality, integrity, and availability.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI) · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50289.json)\n\n**systeminformation: systeminformation: Arbitrary Command Execution via OS Command Injection** — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-23.\n\nAffected:\n\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Cryostat 4\n- Multicluster Engine for Kubernetes\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Developer Hub\n- Red Hat OpenShift AI (RHOAI)\n- Self-service automation portal 2\n\n## Remediation\n\nAffected\n\n## Package advisory (CVE-2026-50289)\n\nAffected packages:\n\n- `systeminformation <= 5.31.6`\n\nPatched in:\n\n- `systeminformation 5.31.7`\n\nSource: https://github.com/advisories/GHSA-5xpp-75jx-m839","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.7,"exploitation":0,"ransomware":0},"changes":[{"seq":228104,"id":"CVE-2026-50289","ts":1792758087042,"field":"cvss","old":null,"new":"8.8"}]}