Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-116673: systeminformation permits local file read via crafted networkStats

CVE-2026-116673 · published 8 days ago

Summary

The systeminformation library for Node.js could be tricked into reading any file it can access on the server when an attacker supplies a specially crafted network interface name and creates a symlinked directory. This may expose sensitive system information to a local attacker. Upgrade to version 5.33.14 or later to fix the issue.

What to do

Update systeminformation to version 5.33.14.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	sebhildebrandt	systeminformation	< 5.33.14
Debian:14	debian	node-systeminformation	All versions
Ubuntu:26.10	canonical	node-systeminformation	All versions
npm	–	systeminformation	< 5.33.14 Fix: upgrade to 5.33.14

Original advisory text

systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

References

https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.14 URL
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4vj... Vendor Advisory
https://github.com/sebhildebrandt/systeminformation/commit/8d294b3139fec654a9129... Patch
https://security-tracker.debian.org/tracker/CVE-2026-116673 Vendor Advisory
https://ubuntu.com/security/CVE-2026-116673 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-116673 Third Party Advisory
https://github.com/advisories/GHSA-4vjg-vx72-qq4g
https://nvd.nist.gov/vuln/detail/CVE-2026-116673 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1166... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

CWE-59Link Following

Timeline

Published27 Oct 2026

Updated30 Oct 2026

First seen27 Oct 2026

Sources

CVE-2026-116673 · NVD

CVE-2026-116673 · MITRE

CVE-2026-116673 · OSV

GHSA-4vjg-vx72-qq4g · GHSA

DEBIAN-CVE-2026-116673 · OSV

UBUNTU-CVE-2026-116673 · OSV

Track software like this

Free during beta