CVE-2026-116673

About vulnerability

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

Affected product:

chromatic-e2e , cypress , cypress-terminal-report , dotenvx-dotenvx , ext-apps , gateway , graphql-hive-gateway , graphql-hive-plugin-opentelemetry , inngest , inngest-ci , inngest-realtime , inngest-test , mastra-google-cloud-pubsub , mastra-inngest , opentelemetry-auto-instrumentations-node , opentelemetry-host-metrics , opentelemetry-instrumentation-host-metrics , percy-cli , percy-cli-app , percy-cli-build , percy-cli-command , percy-cli-config , percy-cli-doctor , percy-cli-exec , percy-cli-snapshot , percy-cli-upload , percy-core , percy-monitoring , shadcn , shadcn-registry , systeminformation , testing-library-cypress

Affected packages:

systeminformation @ 5.27.11 (+314 more)