CVE-2026-116673

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.33.14

Description The Linux implementation of the networkStats(iface) function fails to properly validate the iface variable when performing an fs.existsSync() check and constructing paths under /sys/class/net/. This lack of verification allows an attacker who can control the iface input and create a directory with symlinked statistics files to use parent-directory components and symlink traversal. This can result in the API returning the first line of any file readable by the Node.js process. This issue requires local filesystem setup as the package does not expose a network endpoint.

Recommendations Update systeminformation to version 5.33.14.