On Linux, the systeminformation library's networkInterfaces() function is vulnerable to OS command injection through unsanitized interpolation of paths from 'source' directives in /etc/network/interfaces and its recursively sourced files. The vulnerable function checkLinuxDCHPInterfaces() constructs a shell command string using execSync() with unquoted file path tokens extracted from the file content, allowing shell metacharacters to break out and execute arbitrary commands. This vulnerability arises because the input is read from local configuration files and not sanitized before being used in shell commands. The vulnerability affects version <5.31.7. The networkInterfaces() API is frequently called and reachable transitively, increasing exposure. An attacker able to place or influence files referenced by 'source' directives can achieve command execution with the privileges of the Node.js process using systeminformation.

An attacker who can write or influence files referenced by 'source' directives in /etc/network/interfaces or its sourced files can execute arbitrary OS commands with the privileges of the Node.js process calling networkInterfaces(). If the process runs with elevated privileges, the attacker gains equivalent privilege escalation. This affects local inventory, monitoring, diagnostics, admin dashboards, and device management agents on Linux that use systeminformation versions prior to 5.31.7. The vulnerability is exploitable without special hardware or NetworkManager activation, relying solely on control over sourced configuration files.

A fix is available in systeminformation version 5.31.7 and later. Users should upgrade to version 5.31.7 or newer to eliminate this vulnerability. Until upgrading, avoid running processes that call networkInterfaces() with elevated privileges if untrusted users can influence /etc/network/interfaces or its sourced files. Patch status is confirmed by the versioning information indicating versions prior to 5.31.7 are affected and fixed in 5.31.7.