Affected: npm: systeminformation

## Summary

On Linux, `systeminformation` is vulnerable to command injection in `networkInterfaces()` when an **active NetworkManager connection profile name** contains shell metacharacters.

This is not caused by a caller passing attacker-controlled arguments into `networkInterfaces()`. The vulnerable value is obtained internally from real `nmcli device status` output. The library sanitizes the network interface name before using it in shell commands, but it does **not** apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized `connectionName` is then interpolated into three shell command strings executed through `execSync()`.

This issue was validated locally against **real NetworkManager** and **real `nmcli`**. Calling only:

```js require('./lib').networkInterfaces() ```

was enough to trigger execution. The injected command ran with the privileges of the calling Node.js process.

## Affected Component & Versions

**Affected component:**

- [`lib/network.js`](https://github.com/sebhildebrandt/systeminformation/blob/ed1cac537c59763301d802ad1b55b4b8581e7553/lib/network.js) - `networkInterfaces()` - Linux NetworkManager / `nmcli` handling

## Impact & Threat Model

**Confirmed impact:**

An attacker who can create or rename an **active NetworkManager connection profile** can execute arbitrary shell commands when a Node.js process using `systeminformation` calls `networkInterfaces()`.

**Confirmed realistic affected deployments in…