25 matches found
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
Summary On Linux, [email protected] builds /sys/class/net/ paths from the caller-supplied networkStatsiface value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function...
GHSA-4VJG-VX72-QQ4G systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
Summary On Linux, [email protected] builds /sys/class/net/ paths from the caller-supplied networkStatsiface value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function...
EUVD-2026-111101
systeminformation has path traversal in Linux networkStats that allows symlink-based file disclosure outside /sys/class/net...
npm: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
npm: systeminformation has path traversal in Linux networkStats that allows symlink-based file disclosure outside /sys/class/net vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.14...
systeminformation has prototype pollution in `networkStats()` via the interface name
Summary networkStats keeps a per interface cache for computing rxsec / txsec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name proto makes every cache write land on Object.prototype instead of the cache, polluting...
EUVD-2026-111104
systeminformation has prototype pollution in networkStats via the interface name...
GHSA-7648-JMWF-VW7J systeminformation has prototype pollution in `networkStats()` via the interface name
Summary networkStats keeps a per interface cache for computing rxsec / txsec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name proto makes every cache write land on Object.prototype instead of the cache, polluting...
npm: systeminformation has prototype pollution in `networkStats()` via the interface name
npm: systeminformation has prototype pollution in networkStats via the interface name vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.13...
CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
DEBIAN-CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
UBUNTU-CVE-2026-116674
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...
UBUNTU-CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
CVE-2026-116674 systeminformation: Prototype pollution in `networkStats()` via the interface name
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...
CVE-2026-116674
The systeminformation library for Node.js is vulnerable to Prototype Pollution in the networkStats(ifaces) function within lib/network.js on FreeBSD , OpenBSD , and NetBSD systems. Prior to version 5.33.13 , the library stores per-interface data in a plain-object cache and indexes it using a call...
CVE-2026-116674 systeminformation: Prototype pollution in `networkStats()` via the interface name
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...
CVE-2026-116673 systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
CVE-2026-116673 systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...
CVE-2026-116673 systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...