systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

影響: npm:systeminformation < 5.33.14 → 5.33.14

On Linux, systeminformation@5.33.13 builds /sys/class/net/ paths from the caller-supplied networkStats(iface) value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function return the first line of a file readable by the Node process. Details The strict string sanitizer removes shell metacharacters but retains / and .. The Linux implementation uses this value in an fs.existsSync(…

在 GitHub Advisory Database 阅读

2026/10/29 06:13，GitHub Advisory Database 发布了“systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js、Linux。CVE：CVE-2026-116673。