The systeminformation Node.js library versions >=4.17.0 and <5.31.6 on Linux are affected by an OS command injection vulnerability (CWE-78) in the networkInterfaces() function. The vulnerability occurs because the library obtains the NetworkManager connection profile name from nmcli output and interpolates this unsanitized value into shell commands executed via execSync(). While the network interface name is sanitized, the connection profile name is not, allowing injection of shell metacharacters. This can lead to arbitrary command execution with the privileges of the running process. The vulnerability is fixed in version 5.31.6. The CVSS v3.1 base score is 7.8, indicating high severity with local attack vector, low complexity, requiring privileges, no user interaction, and impacts confidentiality, integrity, and availability.

An attacker with local privileges on a Linux system running a vulnerable version of systeminformation can exploit this vulnerability by crafting a NetworkManager connection profile name containing shell metacharacters. This leads to arbitrary command execution within the context of the Node.js process using systeminformation, potentially compromising system confidentiality, integrity, and availability.

A fix is available in systeminformation version 5.31.6. Users should upgrade to version 5.31.6 or later to remediate this vulnerability. The vendor advisory from Red Hat confirms the fix in 5.31.6. No alternative mitigations are specified in the advisory.