sebhildebrandt systeminformation up to 5.33.12 Network Statistics lib/network.js networkStats dynamically-determined object attributes

Summaryinfo

A vulnerability marked as critical has been reported in sebhildebrandt systeminformation up to 5.33.12. This affects the function networkStats of the file lib/network.js of the component Network Statistics. Performing a manipulation results in dynamically-determined object attributes. This vulnerability was named CVE-2026-116674. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in sebhildebrandt systeminformation up to 5.33.12. This affects the function networkStats of the file lib/network.js of the component Network Statistics. The manipulation with an unknown input leads to a dynamically-determined object attributes vulnerability. CWE is classifying the issue as CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. This is going to have an impact on integrity, and availability. The summary by CVE is:

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-116674 since 10/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 5.33.13 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• sebhildebrandt

Name

• systeminformation

Version

• 5.33.0
• 5.33.1
• 5.33.2
• 5.33.3
• 5.33.4
• 5.33.5
• 5.33.6
• 5.33.7
• 5.33.8
• 5.33.9
• 5.33.10
• 5.33.11
• 5.33.12

Website

• Product: https://github.com/sebhildebrandt/systeminformation/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion