The vulnerability allows an attacker to inject and execute arbitrary shell commands on a vulnerable Linux system running the systeminformation library. By manipulating the source directive in the /etc/network/interfaces file, the library’s internal function interpolates the path unquoted into a shell command that is executed with execSync. The resulting command execution can occur whenever any process invokes networkInterfaces(), including high‑privilege internal functions such as getStaticData() and getAllData(). This flaw represents a classic OS command injection problem (CWE‑78) with the potential to compromise confidentiality, integrity, and availability of the affected system.

The issue affects the systeminformation library maintained by sebhildebrandt, used in node.js applications. All releases prior to version 5.31.7 are vulnerable when running on Linux distributions that use the /etc/network/interfaces file, such as Debian and Ubuntu. End‑user applications that import the library and call networkInterfaces() are impacted.

The CVSS score of 8.7 indicates high severity, and an EPSS score of 1% suggests moderate exploit probability given the relatively recent patch. The vulnerability is not listed in the CISA KEV catalog, but its high impact warrants attention. The likely attack vector is local or application‑level; any process with permission to read /etc/network/interfaces and invoke networkInterfaces() can trigger the injection, potentially allowing an attacker to elevate privileges or compromise the entire system.