systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

影響: npm:systeminformation < 5.33.14 → 5.33.14

On Linux, systeminformation@5.33.13 builds /sys/class/net/ paths from the caller-supplied networkStats(iface) value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function return the first line of a file readable by the Node process. Details The strict string sanitizer removes shell metacharacters but retains / and .. The Linux implementation uses this value in an fs.existsSync(…

Read on GitHub Advisory Database

On 10/29/2026, 06:13 AM, GitHub Advisory Database published "systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js, Linux. CVE: CVE-2026-116673.