CVE-2026-50289High· 8.8▾ TwilightA flaw was found in systeminformation, a Node.js library. A remote attacker can exploit an operating system (OS) command injection vulnerability in the `networkInterfaces()` function on Linux. This occurs because the library improperly han…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
1.9%
1.9% → 3.6%
Last analysed / modified upstream
— → 8.8
A flaw was found in systeminformation, a Node.js library. A remote attacker can exploit an operating system (OS) command injection vulnerability in the networkInterfaces() function on Linux. This occurs because the library improperly handles paths from /etc/network/interfaces, allowing an attacker to inject and execute arbitrary commands. This could lead to significant compromise of system confidentiality, integrity, and availability.
systeminformation: systeminformation: Arbitrary Command Execution via OS Command Injection — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-23.
Affected:
No fix planned:
Not affected:
Affected
Affected packages:
systeminformation <= 5.31.6Patched in:
systeminformation 5.31.7Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-6193Medium· 5.9A command injection vulnerability was discovered in the TrustyAI Explainability toolkit
CVE-2026-67325High· 8.8GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature
CVE-2026-67324Critical· 9.8GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
CVE-2026-114128Medium· 6.1astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements (CVE-2026-114128)
CVE-2026-107832Low· 3.7fastify is a fast and low overhead web framework for Node.js