{"id":"ghsa-ghsa-7648-jmwf-vw7j","seq":2056936,"kind":"advisory","title":"systeminformation has prototype pollution in `networkStats()` via the interface name","url":"https://github.com/advisories/GHSA-7648-jmwf-vw7j","permalink":"https://vulnpulse.app/items/ghsa-ghsa-7648-jmwf-vw7j","summary":"影響: npm:systeminformation < 5.33.13 → 5.33.13\nnetworkStats() keeps a per interface cache for computing rx_sec / tx_sec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name __proto__ makes every cache write land on Object.prototype instead of the cache, polluting every object in the Node.js process. An application is affected if it passes untrusted input as the ifaces argument of si.networkStats() and runs on FreeBSD, OpenBSD or NetBSD. Details The vulnerable code…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-116674"],"tags":["GHSA-7648-jmwf-vw7j","systeminformation"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:13:32.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}