diff --git a/.changeset/systeminformation-command-injection.md b/.changeset/systeminformation-command-injection.md
new file mode 100644
index 0000000000..128eb622b0
--- /dev/null
+++ b/.changeset/systeminformation-command-injection.md
@@ -0,0 +1,11 @@
+---
+'@hyperdx/api': patch
+---
+
+fix: update systeminformation to 5.33.19
+
+The root `resolutions` pin let the lockfile keep systeminformation 5.30.7, which
+has known command injection advisories, including two high-severity ones in
+`networkInterfaces()` on Linux (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The
+API installs it through `@opentelemetry/host-metrics`. The pin now starts at
+5.33.19, the newest 5.x release, which fixes all of them.
diff --git a/package.json b/package.json
index 6659ab07d9..cdcdf52b50 100644
--- a/package.json
+++ b/package.json
@@ -85,7 +85,7 @@
     "diff": "^5.2.2",
     "on-headers": "^1.1.0",
     "fast-xml-parser": "^4.5.6",
-    "systeminformation": "^5.24.0",
+    "systeminformation": "^5.33.19",
     "@asyncapi/specs": "6.11.1"
   },
   "resolutionsNotes": {
diff --git a/yarn.lock b/yarn.lock
index b8009a3c03..1840c79899 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -29282,12 +29282,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"systeminformation@npm:^5.24.0":
-  version: 5.30.7
-  resolution: "systeminformation@npm:5.30.7"
+"systeminformation@npm:^5.33.19":
+  version: 5.33.19
+  resolution: "systeminformation@npm:5.33.19"
   bin:
     systeminformation: lib/cli.js
-  checksum: 10c0/62588fabe62ec258d56055e609a075fe1eb1da2f090adc8c53e025ad8947d6eb9d3d2889646973fafba9528e06958decbb1def2b989af0363a952c5aff65fbae
+  checksum: 10c0/cb95464c1ab9b5deabd0141d0ae22db29ced520f321c2b5cbcdea84eff5d0cf65fbb521a9945f8dc98e560bc9fc57cbe06e68dd2d34c53a4c3a59eb61d0535b3
   conditions: (os=darwin | os=linux | os=win32 | os=freebsd | os=openbsd | os=netbsd | os=sunos | os=android)
   languageName: node
   linkType: hard