Log in Start free

Vulnerability · Published Oct 27, 2026 · Assigned by GitHub_M

CVE-2026-116673systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

Low 3.3

In plain English

A low-severity path traversal in systeminformation from sebhildebrandt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 97.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14node-systeminformationno fix listedDEBIAN-CVE-2026-116673
Ubuntu:26.10node-systeminformationno fix listedUBUNTU-CVE-2026-116673
npmsysteminformation5.33.14GHSA-4vjg-vx72-qq4g

Affected products (as reported)

VendorProductVersions
sebhildebrandt systeminformation < 5.33.14

Weakness: CWE-22, CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References