{"id":"ghsa-ghsa-4vjg-vx72-qq4g","seq":2056935,"kind":"advisory","title":"systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net","url":"https://github.com/advisories/GHSA-4vjg-vx72-qq4g","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4vjg-vx72-qq4g","summary":"影響: npm:systeminformation < 5.33.14 → 5.33.14\nOn Linux, systeminformation@5.33.13 builds /sys/class/net/ paths from the caller-supplied networkStats(iface) value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function return the first line of a file readable by the Node process. Details The strict string sanitizer removes shell metacharacters but retains / and .. The Linux implementation uses this value in an fs.existsSync(…","severity":"low","techs":["nodejs","linux"],"cves":["CVE-2026-116673"],"tags":["GHSA-4vjg-vx72-qq4g","systeminformation"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:13:50.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}