28 matches found
CVE-2026-116673
A flaw was found in systeminformation. The library fails to properly validate user-supplied network interface names when querying network statistics on Linux systems. A local attacker who can control this parameter and create symbolic links on the local filesystem can exploit this path traversal...
GHSA-4VJG-VX72-QQ4G systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
Summary On Linux, [email protected] builds /sys/class/net/ paths from the caller-supplied networkStatsiface value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function...
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
Summary On Linux, [email protected] builds /sys/class/net/ paths from the caller-supplied networkStatsiface value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function...
npm: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
npm: systeminformation has path traversal in Linux networkStats that allows symlink-based file disclosure outside /sys/class/net vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.14...
EUVD-2026-111101
systeminformation has path traversal in Linux networkStats that allows symlink-based file disclosure outside /sys/class/net...
GHSA-7648-JMWF-VW7J systeminformation has prototype pollution in `networkStats()` via the interface name
Summary networkStats keeps a per interface cache for computing rxsec / txsec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name proto makes every cache write land on Object.prototype instead of the cache, polluting...
systeminformation has prototype pollution in `networkStats()` via the interface name
Summary networkStats keeps a per interface cache for computing rxsec / txsec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name proto makes every cache write land on Object.prototype instead of the cache, polluting...
EUVD-2026-111104
systeminformation has prototype pollution in networkStats via the interface name...
npm: systeminformation has prototype pollution in `networkStats()` via the interface name
npm: systeminformation has prototype pollution in networkStats via the interface name vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.13...
CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
Linux Distros Unpatched Vulnerability : CVE-2026-116673
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied...
DEBIAN-CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
UBUNTU-CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
UBUNTU-CVE-2026-116674
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...
CVE-2026-116674 systeminformation: Prototype pollution in `networkStats()` via the interface name
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...
CVE-2026-116674 systeminformation: Prototype pollution in `networkStats()` via the interface name
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...
CVE-2026-116674
The systeminformation library for Node.js is vulnerable to Prototype Pollution in the networkStats(ifaces) function within lib/network.js on FreeBSD , OpenBSD , and NetBSD systems. Prior to version 5.33.13 , the library stores per-interface data in a plain-object cache and indexes it using a call...
CVE-2026-116673
The systeminformation library for Node.js (versions prior to 5.33.14 ) contains a path traversal vulnerability in the Linux networkStats(iface) implementation. The issue occurs because the library fails to verify that the caller-supplied iface value is a single segment or remains under the /sys/c...