systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux,
    systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager
    connection profile name contains shell metacharacters. The vulnerable value is obtained internally from
    real nmcli device status output. The library sanitizes the network interface name before using it in shell
    commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile
    name. That unsanitized connectionName is then interpolated into three shell command strings executed
    through execSync(). This vulnerability is fixed in 5.31.6. (CVE-2026-44724)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux,     systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager     connection profile name contains shell metacharacters. The vulnerable value is obtained internally from     real nmcli device status output. The library sanitizes the network interface name before using it in shell     commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile     name. That unsanitized connectionName is then interpolated into three shell command strings executed     through execSync(). This vulnerability is fixed in 5.31.6. (CVE-2026-44724)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463896	Echo: systeminformation: security update to 5.31.6	Tenable Cloud Security	Echo Local Security Checks	Local	high
463896	Echo: systeminformation: security update to 5.31.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
318460	Linux Distros Unpatched Vulnerability : CVE-2026-44724	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-44724

high

Tenable Plugins

high

high

high