OS Command Injection in systeminformation - CVE-2026-44724

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU130997

OS Command Injection in systeminformation - CVE-2026-44724

Published: May 11, 2026


Vulnerability identifier: #VU130997
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44724
CWE-ID: CWE-78
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to execute arbitrary commands.

The vulnerability exists due to command injection in networkInterfaces() in lib/network.js when processing an active NetworkManager connection profile name obtained from nmcli output. A local user can create or rename an active NetworkManager connection profile with shell metacharacters to execute arbitrary commands.

The injected command runs with the privileges of the calling Node.js process.


Affected software

systeminformation
Maximo Application Suite - Monitor Component

How to mitigate CVE-2026-44724

Install security update from vendor's website.

systeminformation - update to 5.31.6
Maximo Application Suite - Monitor Component - addressed in versions 9.0.22, 9.1.12

External References

Related Security Bulletins