---
id: CVE-2026-50289
title: >-
  systeminformation: systeminformation: Arbitrary Command Execution via OS
  Command Injection (CVE-2026-50289)
summary: >-
  A flaw was found in systeminformation, a Node.js library. A remote attacker
  can exploit an operating system (OS) command injection vulnerability in the
  `networkInterfaces()` function on Linux. This occurs because the library
  improperly han…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-78
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - openshift_ai_rhoai
patched:
  - systeminformation 5.31.7
published: '2026-07-17'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T21:27:26+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50289.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50289.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-50289'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2501887'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-50289'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50289'
  - url: >-
      https://github.com/sebhildebrandt/systeminformation/commit/bbfddde48672d0ee124fefdb3cb4442fd9dd4f03
  - url: 'https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.31.7'
  - url: >-
      https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-5xpp-75jx-m839
  - url: 'https://github.com/advisories/GHSA-5xpp-75jx-m839'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.03557
epssPercentile: 0.89262
aliases:
  - GHSA-5xpp-75jx-m839
ecosystem: npm
ingestedAt: '2026-07-15T23:47:19.056Z'
---

## Overview

A flaw was found in systeminformation, a Node.js library. A remote attacker can exploit an operating system (OS) command injection vulnerability in the `networkInterfaces()` function on Linux. This occurs because the library improperly handles paths from `/etc/network/interfaces`, allowing an attacker to inject and execute arbitrary commands. This could lead to significant compromise of system confidentiality, integrity, and availability.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI) · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50289.json)

**systeminformation: systeminformation: Arbitrary Command Execution via OS Command Injection** — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-23.

Affected:

- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Red Hat OpenShift AI (RHOAI)

Not affected:

- Cryostat 4
- Multicluster Engine for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Developer Hub
- Red Hat OpenShift AI (RHOAI)
- Self-service automation portal 2

## Remediation

Affected

## Package advisory (CVE-2026-50289)

Affected packages:

- `systeminformation <= 5.31.6`

Patched in:

- `systeminformation 5.31.7`

Source: https://github.com/advisories/GHSA-5xpp-75jx-m839