Most recent entries from all

fkie_cve-2026-116673

2026-11-02T05:01:56.428024+00:00

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

GHSA-4vjg-vx72-qq4g — systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/cla…

2026-11-02T05:01:56.428160+00:00

Affected: npm: systeminformation

### Summary

On Linux, `systeminformation@5.33.13` builds `/sys/class/net/` paths from the caller-supplied `networkStats(iface)` value without checking that the resolved path stays inside `/sys/class/net`. A caller who can create a symlink fixture and control the value passed to this API can make the function return the first line of a file readable by the Node process.

### Details

The strict string sanitizer removes shell metacharacters but retains `/` and `.`. The Linux implementation uses this value in an `fs.existsSync('/sys/class/net/' + iface)` check and then in seven `cat` paths for interface statistics. Both operations follow `..` path components and symlinks. The code does not validate the value as an interface name or enforce resolved-path containment.

The proof of concept below creates the expected statistics files in a directory writable by the unprivileged `nobody` user. Its `operstate` symlink points to a synthetic mode-0600 file under `/root`. The package call runs as root and returns the marker even though `nobody` cannot read that file.

### PoC

Use a disposable Ubuntu Linux VM with Node.js, npm, and `runuser` installed. These steps create and remove only a synthetic marker and a temporary fixture. Install the affected version:

```sh mkdir si-netstats-repro cd si-netstats-repro npm init -y npm install systeminformation@5.33.13 ```

Save the following as `poc.cjs` in that directory, then run `sudo node poc.cjs`:

```js 'use strict';

const fs = re…

UBUNTU-CVE-2026-116673

2026-11-02T05:01:56.428262+00:00

Affected: Ubuntu:26.10: node-systeminformation