Is CVE-2026-44724 actively exploited?

No active exploitation of CVE-2026-44724 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44724 be exploited remotely?

No. CVE-2026-44724 requires local access to exploit.

What is the CVSS score of CVE-2026-44724?

CVE-2026-44724 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-44724

HIGH

CVE-2026-44724

CWE-78Published: May 27, 2026· Updated: Jun 1, 2026

7.8

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:16.3th

Official Description

systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.

NVD Source

Technical Analysis

CVE-2026-44724 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.