systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

影響: npm:systeminformation < 5.33.14 → 5.33.14

On Linux, systeminformation@5.33.13 builds /sys/class/net/ paths from the caller-supplied networkStats(iface) value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function return the first line of a file readable by the Node process. Details The strict string sanitizer removes shell metacharacters but retains / and .. The Linux implementation uses this value in an fs.existsSync(…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:13, GitHub Advisory Database에서 "systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js, Linux. CVE: CVE-2026-116673.