{"id":"CVE-2026-116673","kind":"vulnerability","aliases":["CVE-2026-116673"],"related":[],"title":"systeminformation: path traversal in networkStats reads first line of local files","description":"systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.","summary":"The systeminformation Node.js library's Linux networkStats(iface) function builds /sys/class/net paths from a caller-supplied interface name without checking it. An attacker who controls that input and can place symlinked files on disk can make the API return the first line of any file the Node.js process can read.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","node.js","package","systeminformation"],"not_affected_if":["fixed-interface-names","no-networkstats-use","non-linux"],"how_to_check":"- Run `npm ls systeminformation` in each project to find installed versions below `5.33.14`.\n- Check whether the application passes user-controlled values into `networkStats(iface)`.","fix":"- Upgrade the `systeminformation` package to `5.33.14` or later.\n- Validate interface names to a single path segment before calling `networkStats` if you pass external input.","status":"open","published_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:35:02+00:00","updated_at":"2026-10-27T17:35:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T17:35:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `systeminformation` package to `5.33.14` or later.\n- Validate interface names to a single path segment before calling `networkStats` if you pass external input.","reach":"local","title":"systeminformation: path traversal in networkStats reads first line of local files","impact":"low","summary":"The systeminformation Node.js library's Linux networkStats(iface) function builds /sys/class/net paths from a caller-supplied interface name without checking it. An attacker who controls that input and can place symlinked files on disk can make the API return the first line of any file the Node.js process can read.","category":"package","nicknames":[],"who_cares":["node.js","linux","systeminformation"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker reads first line of a locally readable file","analyst_note":"","how_to_check":"- Run `npm ls systeminformation` in each project to find installed versions below `5.33.14`.\n- Check whether the application passes user-controlled values into `networkStats(iface)`.","needs_analyst":false,"not_affected_if":["fixed-interface-names","no-networkstats-use","non-linux"],"who_is_affected":"Applications on Linux that call systeminformation's networkStats with an interface value an attacker can influence, and where the attacker can also create symlinked files on the host. The sources say the package exposes no network endpoint and the demonstrated scenario needs local filesystem setup, so services that only pass fixed interface names are low risk. Teams that never call networkStats with external input can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000622,"input_tokens":3430,"output_tokens":558,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116673':14A,17A '-2026':13A,16A '/sys/class/net':32B,105C,129C '5.33.14':85C,191C 'api':60B,156C 'attack':45B,131C 'build':31B,104C 'caller':37B,94C 'caller-suppli':36B,93C 'check':42B,101C 'compon':149C 'contain':140C 'control':47B,134C 'creat':137C 'cve':12A,15A 'demonstr':179C 'directori':139C,148C 'disk':56B 'endpoint':176C 'expos':173C 'file':11A,54B,67B,143C,163C 'filesystem':183C 'first':7A,63B,159C 'fix':188C 'fs.existssync':100C 'function':30B 'ifac':29B,89C,135C 'implement':90C 'includ':107C 'inform':79C 'input':49B 'interfac':39B,96C,119C 'interface-nam':118C 'issu':186C 'librari':25B,80C 'line':8A,64B,160C 'linux':18B,27B,87C 'local':10A,182C 'make':58B,154C 'name':40B,120C 'network':175C 'networkstat':5A,28B,88C 'node.js':19B,24B,69B,82C,167C 'operst':109C 'os':78C 'packag':20B,170C 'parent':147C 'parent-directori':146C 'path':2A,33B,106C,110C,126C 'place':52B 'prior':83C 'process':70B,168C 'read':6A,72B 'readabl':164C 'remain':127C 'requir':181C 'resolv':125C 'return':61B,157C 'scenario':180C 'segment':121C 'setup':184C 'singl':117C 'statist':142C 'suppli':38B,95C 'symlink':53B,141C,151C 'system':76C 'systeminform':1A,21B,23B,73C 'travers':3A,152C 'use':91C,145C 'valu':97C 'verifi':112C 'version':190C 'without':41B,111C","nicknames":[],"mitigations":[],"who_affected":"Applications on Linux that call systeminformation's networkStats with an interface value an attacker can influence, and where the attacker can also create symlinked files on the host. The sources say the package exposes no network endpoint and the demonstrated scenario needs local filesystem setup, so services that only pass fixed interface names are low risk. Teams that never call networkStats with external input can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116673","severity":null,"published_at":"2026-10-27T17:16:59+00:00","modified_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}