CyberRota Analysis
AI-GeneratedThe systeminformation library for Node.js versions prior to 5.31.7 is vulnerable to OS command injection on Linux systems, specifically through the networkInterfaces() function when processing the /etc/network/interfaces file. This vulnerability allows an attacker to execute arbitrary commands by injecting shell metacharacters into the source path, potentially compromising any process that utilizes this function. Organizations using affected versions on Linux, Ubuntu, or Debian should prioritize upgrading to version 5.31.7 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source <path> token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null | grep 'iface\|source' executed by execSync(cmd, util.execOptsLinux), allowing a path containing shell metacharacters to execute commands in any process that calls networkInterfaces(), including via getStaticData() and getAllData(). This issue is fixed in version 5.31.7.
Related CVEs
Other vulnerabilities affecting the same vendor(s)