systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux
    networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check
    and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a
    single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can
    control iface and create a directory containing symlinked statistics files can use parent-directory
    components and symlink traversal to make the API return the first line of a file readable by the Node.js
    process. The package does not expose a network endpoint, and the demonstrated scenario requires local
    filesystem setup. This issue is fixed in version 5.33.14. (CVE-2026-116673)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux     networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check     and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a     single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can     control iface and create a directory containing symlinked statistics files can use parent-directory     components and symlink traversal to make the API return the first line of a file readable by the Node.js     process. The package does not expose a network endpoint, and the demonstrated scenario requires local     filesystem setup. This issue is fixed in version 5.33.14. (CVE-2026-116673)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477806	SCA: security update for systeminformation (GHSA-4vjg-vx72-qq4g)	Tenable Cloud Security	SCA Checks	Local	low
477806	SCA: security update for systeminformation (GHSA-4vjg-vx72-qq4g)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
372976	Linux Distros Unpatched Vulnerability : CVE-2026-116673	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-116673

low

Tenable Plugins

low

low

low