Detections
Analytics

SCA: security update for systeminformation (GHSA-7648-jmwf-vw7j)

medium Tenable Self-Hosted Container Security Plugin ID 477797

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - systeminformation is a System and OS information library for node.js. Prior to 5.33.13,
 networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the
 plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing
 proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so
 calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto
 Object.prototype. The polluted property names are fixed and their values come from interface statistics,
 but inherited-name collisions and enumerable keys can corrupt application branching, serialization,
 configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.
 (CVE-2026-116674)

Solution

Update the systeminformation library and its related packages to version 5.33.13 or later.

See Also

https://github.com/advisories/GHSA-7648-jmwf-vw7j

Plugin Details

Severity: Medium

ID: 477797

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/29/2026

Updated: 10/29/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.47

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:P

CVSS Score Source: CVE-2026-116674

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/28/2026

Vulnerability Publication Date: 10/27/2026

Reference Information

CVE: CVE-2026-116674