CVE-2026-50289

Executive Summary

CVE-2026-50289 is an OS command injection vulnerability in the systeminformation Node.js library, affecting all versions prior to 5.31.7. The flaw resides in the networkInterfaces() function on Linux systems, which improperly handles the source directive from the Debian/Ubuntu interfaces(5) configuration file. An attacker able to write or influence the contents of /etc/network/interfaces (or any file sourced by it) can achieve remote code execution with the privileges of any process calling networkInterfaces(), including through getStaticData() and getAllData(). The vulnerability carries a CVSS score of 8.8 (High) and is confirmed fixed in version 5.31.7.

Technical Analysis

The vulnerability exists in the file lib/network.js, specifically within the function checkLinuxDCHPInterfaces(). This function is responsible for determining DHCP configuration on Linux by parsing the /etc/network/interfaces file. The code flow is as follows:

1. On Linux, networkInterfaces() is invoked by applications to enumerate network adapters and configuration.
2. Internally, the library invokes checkLinuxDCHPInterfaces(), which reads /etc/network/interfaces using fs.readFileSync().
3. The function scans file content for lines starting with iface or source tokens.
4. When a source <path> directive is found, the extracted <path> string is concatenated directly into a shell command:

cat ${file} 2> /dev/null | grep 'iface\|source'

5. The resulting command string is executed via execSync(cmd, util.execOptsLinux).

Critically, the file variable — derived from the source directive's path — is interpolated unquoted into the shell command. If an attacker can place a file at a path containing shell metacharacters (e.g., $(malicious_command) or ; command), the execSync() call will execute the injected command. Because execSync invokes /bin/sh, all standard shell features (command substitution, semicolons, pipes, redirection) are available.

Attack Surface: The primary attack vector requires the ability to write to /etc/network/interfaces or to a file path referenced by a source directive within it. This is typically a root-level operation. However, in containerized environments, misconfigured volumes, or systems where network configuration is managed by lower-privileged automation, an attacker who achieves any write access to the file system in those locations can trigger code execution. Any Node.js application using systeminformation whose process calls networkInterfaces(), getStaticData(), or getAllData() becomes an execution vector.

The CWE classification is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No known workarounds exist.

Exploitation Scenarios

Prerequisites: Attacker must be able to write to /etc/network/interfaces or a path referenced by its source directive. No authentication is required against the Node.js application itself; the injection is triggered automatically when the library processes the interface file.

Step-by-step attack chain:

1. Reconnaissance: Attacker identifies a target running a Node.js application that imports systeminformation (package version < 5.31.7). This can be discovered via directory traversal, exposed package.json, or JS source maps.

2. Write Access: Attacker gains write access to a file referenced by the vulnerable source directive. This could be via:

   • A writable Docker volume mounted at /etc/network/interfaces or a subpath
   • A compromised system service with root privileges that writes network config
   • A cron job that merges attacker-controlled config into the network directory

3. Craft Payload: Attacker creates a file with a path containing a command substitution payload. For example, if the attacker can create a file named /tmp/$(id > /tmp/pwned)/config, the attacker adds the line source /tmp/$(id > /tmp/pwned)/config to /etc/network/interfaces.

4. Trigger: The Node.js application calls networkInterfaces() (e.g., via a health check endpoint, monitoring poll, or dashboard refresh). The library constructs the command:

   cat /tmp/$(id > /tmp/pwned)/config 2> /dev/null | grep 'iface\|source'
   

   The shell interprets $(id > /tmp/pwned) and executes it before running cat.

5. Code Execution: The injected command runs with the privileges of the Node.js process. The attacker can then establish persistence, exfiltrate data, or pivot laterally.

Exploit availability: A proof-of-concept is publicly available. No Nuclei template or full exploit code has been published. EPSS score is 0.01873% (77.3rd percentile), indicating moderate likelihood of exploitation.

Impact Assessment

The CVSS v3.1 score of 8.8 (High) reflects the following subscores:

• Attack Vector (AV:N): Network — the target can be reached via network, though the initial write access is logical.
• Attack Complexity (AC:L): Low — no special conditions beyond file write access.
• Privileges Required (PR:L): Low — attacker needs low-privileged access sufficient to write config files in the specific path.
• User Interaction (UI:N): None — no user action required.
• Confidentiality (C:H): High — full file read access on the compromised host.
• Integrity (I:H): High — arbitrary command execution enables system modification.
• Availability (A:H): High — attacker can disrupt services or destroy data.

Business impact: This is a code execution vulnerability in an extremely popular library (used by monitoring tools, DevOps pipelines, and administration dashboards). A successful exploit yields:

• Complete compromise of the Node.js process's host
• Access to environment variables, secrets, and API keys
• Potential lateral movement if the service runs in a privileged container or on a shared host
• Data exfiltration from the local file system

Blast radius: Any Linux system running a Node.js application with systeminformation < 5.31.7. The vulnerability propagates transitively via getStaticData() and getAllData(), both of which invoke networkInterfaces(), expanding the exploitable surface beyond direct library users.

Detection Guidance

Sigma Rule

title: CVE-2026-50289 - systeminformation Command Injection via interfaces Source
id: 8a3c9d1e-6f2b-4c7e-9a5d-3e1f8b0c2a4d
status: experimental
description: Detects execution of /etc/network/interfaces with shell metacharacters in path
author: valtersit.com Threat Intel Team
date: 2026/05/15
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/node'
        CommandLine|contains|all:
            - 'cat '
            - '/etc/network/interfaces'
            - 'grep'
        CommandLine|contains:
            - '; '
            - '$(   '
            - '`'
            - '|'
    condition: selection
level: high
fields:
    - User
    - ParentImage
    - CommandLine
falsepositives:
    - Legitimate systeminformation usage with standard interface files (no metacharacters)
    - Custom scripts that parse network config in similar ways
tags:
    - attack.execution
    - attack.t1059.004
    - cve.2026.50289

YARA Rule

rule CVE_2026_50289_Systeminformation_Command_Injection
{
    meta:
        author = "valtersit.com Threat Intelligence"
        date = "2026-05-15"
        description = "Detects malicious /etc/network/interfaces content with source directive containing shell metacharacters"
        cve = "CVE-2026-50289"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50289"
    strings:
        $source_directive = "source "
        $cmd_sub = "$("
        $semicolon = ";"
        $backtick = "`"
        $pipe = "|"
        $iface = "iface "
        $interfaces_path = "/etc/network/interfaces"
    condition:
        filesize < 10KB and
        $interfaces_path and
        $source_directive and
        any of ($cmd_sub, $semicolon, $backtick, $pipe) and
        ($iface or $source_directive)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-50289 - systeminformation Command Injection Attempt"; flow:established,to_server; content:"/etc/network/interfaces"; nocase; content:"source"; nocase; content:"$("; distance:0; pcre:"/source\s+\/\S*\$\(/i"; sid:202650289; rev:1; classype:attempted-admin; reference:cve,2026-50289; priority:1;)

Elastic Detection

process where event.action == "exec" and process.name == "node" and
  process.command_line contains "cat " and
  process.command_line contains "/etc/network/interfaces" and
  (process.command_line contains "$(" or process.command_line contains "; " or
   process.command_line contains "`" or process.command_line contains "|" or
   process.command_line contains "&&" or process.command_line contains "||")

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=process_creation
| where Image LIKE "%/node" AND CommandLine LIKE "%/etc/network/interfaces%"
| where CommandLine LIKE "%cat %" AND CommandLine LIKE "%grep%"
| where CommandLine LIKE "%$(%" OR CommandLine LIKE "%;%" OR CommandLine LIKE "%`%" OR CommandLine LIKE "%|%" OR CommandLine LIKE "%&&%" OR CommandLine LIKE "%||%"
| table _time, host, User, Image, CommandLine, ParentImage
| sort - _time

Wazuh OSSEC Rule

<rule id="523449" level="12">
    <if_sid>50000</if_sid>
    <match>cat /etc/network/interfaces</match>
    <regex>\$\(|; |`|\| |&&|\|\|</regex>
    <description>CVE-2026-50289: Possible command injection through systeminformation networkInterfaces() execution</description>
    <group>ossec,attck_execution,cve_2026_50289,</group>
    <mitre>
        <id>T1059.004</id>
    </mitre>
    <info type="cve">CVE-2026-50289</info>
</rule>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources [NVD, OSV] confirm the fix in version 5.31.7).

1) Immediate Mitigations (apply if you cannot upgrade immediately):

• Block write access to /etc/network/interfaces and all directories referenced by its source directives. Ensure only root (or specific service accounts) can modify these paths.
• Static code analysis: Audit your codebase to identify any calls to networkInterfaces(), getStaticData(), or getAllData() and ensure these functions are not exposed to untrusted input.
• Run Node.js processes in containers with read-only root filesystems and no write access to /etc/network. This limits the attack surface even if other services are compromised.
• Monitor file integrity on /etc/network/interfaces and all sourced paths. Any unexpected changes should trigger immediate investigation.

2) Patch/Upgrade Steps:

# Upgrade systeminformation to the patched version
npm install systeminformation@^5.31.7
# or if using package.json:
# "systeminformation": "^5.31.7"

# Alternatively, use npm audit to check for other vulnerable packages
npm audit

# Restart the Node.js service to load the patched library
systemctl restart <your-service>

3) Long-Term Hardening:

• Enforce least privilege: Run Node.js services with dedicated service accounts that lack write access to system configuration directories.
• Remove execSync usage: If you rely on systeminformation for security-critical functions, evaluate alternative libraries that avoid shell execution (e.g., os.networkInterfaces() from Node.js core).
• Regular dependency auditing: Integrate npm audit or snyk into your CI/CD pipeline to catch known-vulnerable dependencies before deployment.
• Network segmentation: Isolate Node.js applications from each other to limit lateral movement if one host is compromised.

References

• CISA KEV Status: Not listed in CISA's Known Exploited Vulnerabilities catalog as of the report date.
• Exploit-in-the-wild evidence: No verified in-the-wild exploitation has been documented at this time. However, the EPSS score of 0.01873 (77.3rd percentile) indicates the vulnerability is actively being assessed by threat actors.
• Threat actors: No specific APT group or cybercrime syndicate has been publicly attributed with targeting this vulnerability. It is more likely to be exploited by low-skilled actors using the public PoC.
• CWE-78 context: Command injection flaws in Node.js libraries have historically been targeted by crypto-mining botnets (e.g., Kinsing, TeamTNT) and web-shell droppers. Given the library's popularity (~20 million weekly downloads), exploitation could scale quickly if the public PoC is weaponized.
• References: NVD, OSV, vendor GitHub repository, and the CVE issue tracker confirm both the vulnerability and the patched version 5.31.7.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-50289
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-50289
3. Vendor GitHub Repository (commit history): https://github.com/sebhildebrandt/systeminformation/commits/master (commits related to v5.31.7)
4. Node.js os.networkInterfaces() Documentation (alternative): https://nodejs.org/api/os.html#osnetworkinterfaces
5. CWE-78 Reference: https://cwe.mitre.org/data/definitions/78.html