## systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

- 種別: advisory
- 重大度: low
- 関連技術: nodejs, linux
- CVE: CVE-2026-116673
- 公開日時: 2026-10-28T21:13:50.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-4vjg-vx72-qq4g)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-4vjg-vx72-qq4g

影響: npm:systeminformation < 5.33.14 → 5.33.14
On Linux, systeminformation@5.33.13 builds /sys/class/net/ paths from the caller-supplied networkStats(iface) value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function return the first line of a file readable by the Node process. Details The strict string sanitizer removes shell metacharacters but retains / and .. The Linux implementation uses this value in an fs.existsSync(…