Cloudanix VulnDB

CVE-2026-116673

Low · 3.3

CVSS

3.3

EPSS

0.1%

Published

Oct 27, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a popular Node.js system-information library lets someone with local access read the first line of almost any file the program is allowed to see.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The Linux networkStats(iface) implementation in systeminformation accepts an unvalidated caller-supplied interface name, passes it directly to fs.existsSync, and concatenates it into /sys/class/net paths; path traversal sequences combined with attacker-created symlinks allow the function to return the first line of any file readable by the Node.js process.

Why it matters to the business

Local attackers can read sensitive files such as configuration or credential data on Linux systems running affected Node.js applications, increasing risk of credential theft or lateral movement until the library is updated.

How an attack unfolds

An attacker who can control the iface argument to networkStats first creates a directory tree under /sys/class/net containing symlinks that point outside the expected directory, then supplies a traversal string such as '../../../../../target/file'; when the function resolves the operstate or statistics path it follows the symlink and returns the first line of the chosen file.

How to fix it

Upgrade the systeminformation package to version 5.33.14 or later; where immediate upgrade is not possible, avoid passing untrusted values to networkStats on Linux.

How to confirm the fix worked

Confirm the installed version of systeminformation is 5.33.14 or newer; test that networkStats rejects or safely handles interface names containing path separators or parent-directory components.

Typical attack path

  1. Obtain local code execution or influence over the iface parameter passed to networkStats
  2. Create a crafted directory structure containing symlinks under /sys/class/net
  3. Invoke networkStats with a traversal payload that resolves outside /sys/class/net
  4. Receive the first line of the target file in the function return value

How to detect it

Review application logs for networkStats calls that contain path traversal characters or reference unexpected interface names; inspect the /sys/class/net directory for recently created symlinks or non-standard subdirectories.

What your security team should do

  • Upgrade systeminformation to 5.33.14 across all Node.js projects
  • Audit application code for any direct or indirect calls to networkStats with user-controlled input
  • Apply least-privilege file permissions to limit what the Node.js process can read

The record

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities