Live › vulnerability › CVE-2026-116673
Go to dashboardThe systeminformation Node.js library's Linux networkStats(iface) function builds /sys/class/net paths from a caller-supplied interface name without checking it. An attacker who controls that input and can place symlinked files on disk can make the API return the first line of any file the Node.js process can read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Applications on Linux that call systeminformation's networkStats with an interface value an attacker can influence, and where the attacker can also create symlinked files on the host. The sources say the package exposes no network endpoint and the demonstrated scenario needs local filesystem setup, so services that only pass fixed interface names are low risk. Teams that never call networkStats with external input can skip it.
No product ranges from the sources yet.
npm ls systeminformation in each project to find installed versions below 5.33.14.networkStats(iface).systeminformation package to 5.33.14 or later.networkStats if you pass external input.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.
This page as .md · .json · in your agent: get_signal("CVE-2026-116673")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.