systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

影響: npm:systeminformation < 5.33.14 → 5.33.14

On Linux, systeminformation@5.33.13 builds /sys/class/net/ paths from the caller-supplied networkStats(iface) value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function return the first line of a file readable by the Node process. Details The strict string sanitizer removes shell metacharacters but retains / and .. The Linux implementation uses this value in an fs.existsSync(…

GitHub Advisory Databaseで読む

2026/10/29 06:13、GitHub Advisory Databaseが「systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: JavaScript / Node.js、Linux。CVE: CVE-2026-116673。