CVE-2026-116674

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.33.13

Description On FreeBSD, OpenBSD, and NetBSD, the networkStats(ifaces) function in lib/network.js stores per-interface data in a plain-object cache. When the proto value is passed as the ifaces parameter, the system uses the inherited Object.prototype instead of creating a new cache entry. Consequently, the calcNetworkSpeed() function writes rx bytes, tx bytes, rx sec, tx sec, ms, last ms, and operstate directly onto Object.prototype. This leads to prototype pollution, where inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior.

Recommendations Update to version 5.33.13.