CVE-2026-50289: 
JavaScript 취약성 분석 및 완화

CVE-2026-50289 is an OS command injection vulnerability in the systeminformation Node.js library (npm package systeminformation) affecting all versions up to and including 5.31.6. The flaw resides in the networkInterfaces() function on Linux, where the checkLinuxDCHPInterfaces() routine reads /etc/network/interfaces, extracts source <path> directive tokens from file content, and interpolates them unquoted into a shell command executed via execSync(). It was reported by researcher tonghuaroot, published as a GitHub Security Advisory (GHSA-5xpp-75jx-m839) on June 5, 2026, and added to the GitHub Advisory Database on July 15, 2026. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In lib/network.js, the checkLinuxDCHPInterfaces(file) function constructs the shell command `cat ${file} 2> /dev/null | grep 'iface\|source'` and passes it to execSync(), which runs it through /bin/sh. When a source <path> line is encountered, the path token is extracted from file content and recursively passed back into the same function — again unquoted — allowing shell metacharacters (;, $(), backticks, |, &, redirections) to break out of the intended pipeline. Unlike sibling code paths that sanitize interface names and NetworkManager connection names via util.sanitizeString, the source-directive path receives no sanitization before shell interpolation. This sink is reachable transitively through getLinuxDHCPNics() → networkInterfaces() → getStaticData() / getAllData(), meaning ordinary library usage on Linux exercises the vulnerable code path (Github Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the Node.js process that calls networkInterfaces(). If the affected process runs with elevated privileges (e.g., as root or a system service account), the injected commands inherit those privileges, enabling full system compromise including data exfiltration, persistence mechanisms, and lateral movement. Typical affected deployments include local inventory agents, monitoring and diagnostics services, admin-dashboard backends, and device-management agents — all of which commonly call this API on Linux hosts. Confidentiality, integrity, and availability of the vulnerable system are all rated High (Github Advisory).

1. Gain write access: Obtain write access to /etc/network/interfaces, /etc/network/interfaces.d/, or any file transitively sourced by the interfaces configuration — achievable by a lower-privileged local user, a misconfigured service, or a configuration-management hook.
2. Craft a malicious source directive: Write or modify an interfaces file to include a source line whose path contains shell metacharacters, for example:

   source /dev/null;id>/tmp/PWNED;echo

3. Trigger the vulnerable code path: Wait for or cause any process using systeminformation (version ≤ 5.31.6) to call networkInterfaces(), getStaticData(), or getAllData() on the Linux host. This occurs automatically during ordinary library usage (e.g., a monitoring agent polling system state).
4. Achieve command execution: The checkLinuxDCHPInterfaces() function reads the interfaces file, extracts the malicious path token, and interpolates it unquoted into `cat /dev/null;id>/tmp/PWNED;echo 2> /dev/null | grep 'iface\|source'`, which execSync() passes to /bin/sh, executing the injected command with the Node.js process's privileges.
5. Escalate or persist: Use the achieved command execution to establish persistence, exfiltrate data, or escalate privileges if the Node.js process runs as root or a privileged service account (Github Advisory).

• File System: Unexpected files created in /tmp/ or other writable directories by the Node.js process (e.g., marker files, web shells, or exfiltration staging files); unusual modifications to /etc/network/interfaces or files under /etc/network/interfaces.d/ containing shell metacharacters in source directive paths.
• Process: Unexpected child processes spawned by the Node.js process (e.g., /bin/sh, bash, curl, wget, python, nc) visible in process trees; execSync calls producing anomalous output or side effects.
• Logs: Node.js application logs showing errors or unexpected output from networkInterfaces(), getStaticData(), or getAllData() calls; system audit logs (auditd) recording shell command execution initiated by the Node.js process UID.
• Network: Unexpected outbound connections from the Node.js process to external IPs, particularly following calls to networkInterfaces() on Linux systems (Github Advisory).

Upgrade systeminformation to version 5.31.7 or later, which replaces the vulnerable cat ${file} shell string in checkLinuxDCHPInterfaces() with a non-shell fs.readFileSync() call, eliminating the injection sink entirely (Fix Commit, v5.31.7 Release). As a workaround prior to patching, restrict write access to /etc/network/interfaces and all sourced directories (e.g., /etc/network/interfaces.d/) to trusted users only. Additionally, run Node.js processes using systeminformation with the minimum required privileges (principle of least privilege) to limit the impact of any successful exploitation (Github Advisory).

The vulnerability was reported by researcher tonghuaroot and credited in the official GitHub Security Advisory. The advisory notes this is the same root-cause class as a previously fixed NetworkManager-connection-name injection in the same file, highlighting a pattern of incomplete remediation in the library's shell command construction. No significant broader media coverage or notable social media commentary beyond standard vulnerability database aggregation has been observed at this time (Github Advisory).