https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:05:48 +0000 https://vulnerability.circl.lu/vuln/ghsa-hvx9-hwr7-wjj9 <p><strong>Affected:</strong> npm: systeminformation</p> <p>## Summary</p> <p>On Linux, `systeminformation` is vulnerable to command injection in `networkInterfaces()` when an **active NetworkManager connection profile name** contains shell metacharacters.</p> <p>This is not caused by a caller passing attacker-controlled arguments into `networkInterfaces()`. The vulnerable value is obtained internally from real `nmcli device status` output. The library sanitizes the network interface name before using it in shell commands, but it does **not** apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized `connectionName` is then interpolated into three shell command strings executed through `execSync()`.</p> <p>This issue was validated locally against **real NetworkManager** and **real `nmcli`**. Calling only:</p> <p>```js require(&#39;./lib&#39;).networkInterfaces() ```</p> <p>was enough to trigger execution. The injected command ran with the privileges of the calling Node.js process.</p> <p>## Affected Component &amp; Versions</p> <p>**Affected component:**</p> <p>- [`lib/network.js`](https://github.com/sebhildebrandt/systeminformation/blob/ed1cac537c59763301d802ad1b55b4b8581e7553/lib/network.js) - `networkInterfaces()` - Linux NetworkManager / `nmcli` handling</p> <p>## Impact &amp; Threat Model</p> <p>**Confirmed impact:**</p> <p>An attacker who can create or rename an **active NetworkManager connection profile** can execute arbitrary shell commands when a Node.js process using `systeminformation` calls `networkInterfaces()`.</p> <p>**Confirmed realistic affected deployments in…</p> <p><strong>Affected:</strong> npm: systeminformation</p> <p>## Summary</p> <p>On Linux, `systeminformation` is vulnerable to command injection in `networkInterfaces()` when an **active NetworkManager connection profile name** contains shell metacharacters.</p> <p>This is not caused by a caller passing attacker-controlled arguments into `networkInterfaces()`. The vulnerable value is obtained internally from real `nmcli device status` output. The library sanitizes the network interface name before using it in shell commands, but it does **not** apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized `connectionName` is then interpolated into three shell command strings executed through `execSync()`.</p> <p>This issue was validated locally against **real NetworkManager** and **real `nmcli`**. Calling only:</p> <p>```js require(&#39;./lib&#39;).networkInterfaces() ```</p> <p>was enough to trigger execution. The injected command ran with the privileges of the calling Node.js process.</p> <p>## Affected Component &amp; Versions</p> <p>**Affected component:**</p> <p>- [`lib/network.js`](https://github.com/sebhildebrandt/systeminformation/blob/ed1cac537c59763301d802ad1b55b4b8581e7553/lib/network.js) - `networkInterfaces()` - Linux NetworkManager / `nmcli` handling</p> <p>## Impact &amp; Threat Model</p> <p>**Confirmed impact:**</p> <p>An attacker who can create or rename an **active NetworkManager connection profile** can execute arbitrary shell commands when a Node.js process using `systeminformation` calls `networkInterfaces()`.</p> <p>**Confirmed realistic affected deployments in…</p> https://vulnerability.circl.lu/vuln/ghsa-hvx9-hwr7-wjj9