CVE-2026-116673 in systeminformation
Summary
by MITRE • 10/27/2026
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in systeminformation versions prior to 5.33.14 represents a classic path traversal flaw rooted in insufficient input validation within the Linux networkStats implementation. The library, designed for Node.js applications to retrieve operating system and hardware information, accepts an interface name parameter from callers without enforcing strict structural constraints on its format. Specifically, when constructing file paths under /sys/class/net/, the code utilizes fs.existsSync() checks but fails to verify that the provided interface value consists solely of a single valid network interface segment. This oversight allows for the inclusion of parent-directory components such as .. or absolute path sequences, which are not sanitized before being concatenated into the target filesystem location.
The technical mechanism of exploitation relies on the ability of an attacker with local access to manipulate the file system structure relative to where the Node.js process is executing. By creating a directory containing symlinked statistics files that point to sensitive locations within the /sys/class/net hierarchy or other readable paths, an adversary can craft a malicious interface name string. When this crafted input is passed to the networkStats function, the resulting path resolution bypasses intended boundaries due to the lack of canonicalization checks. The application effectively resolves these symlinks and parent directory references, leading it to read from unintended files rather than the specific network statistics file for the requested interface.
The operational impact of this vulnerability centers on unauthorized information disclosure through local filesystem access. Although systeminformation does not expose a network endpoint that would allow remote exploitation over HTTP or other protocols, the flaw is significant in environments where untrusted code can be executed locally within the Node.js context. An attacker who controls the input to this function and has permission to create symlinks on the host machine can force the application to read the first line of any file accessible by the user running the Node.js process. This could potentially expose sensitive configuration data, credentials stored in plaintext files, or other internal system states that were not intended for public consumption via this API method.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict path resolution to the expected directory scope. It also relates to CWE-59: Improper Link Resolution Before File Access, given that symbolic links are resolved without adequate verification of their final destination relative to allowed paths. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates Local Privilege Escalation or Information Discovery techniques where an actor leverages application logic flaws to access restricted resources on the local system.
Mitigation strategies primarily involve upgrading to version 5.33.14 or later, which addresses these path traversal issues by implementing stricter validation of interface names and ensuring that resolved paths remain strictly within the /sys/class/net directory structure. For applications unable to upgrade immediately, developers should implement additional input sanitization layers in their own code before passing data to systeminformation functions. This includes validating that interface strings contain only alphanumeric characters and hyphens typical of Linux network interfaces, rejecting any input containing path separators or dot sequences. Furthermore, running Node.js processes with minimal file system permissions can reduce the blast radius if such a traversal were attempted by limiting which files are readable regardless of how they are accessed.