systeminformation EUVD-2026-111101

Exploitation is specific to the Linux networkStats() code path in systeminformation < 5.33.14; Windows and macOS implementations are not described as affected. Concrete prerequisites: (1) a consuming application must call networkStats(iface) with an attacker-controlled iface value - the package exposes no network endpoint, so untrusted input must reach the API through the host app; (2) the attacker must have local filesystem write access to create a directory containing symlinked statistics files (rx_bytes, tx_bytes, etc.) plus an 'operstate' symlink pointing at the target file; and (3) the iface value must contain '../' parent-directory components to escape /sys/class/net. Limiting factors: local access is required (no remote vector demonstrated), the Node.js process must itself be able to read the target file (the value is privilege-boundary crossing only when a higher-privileged process runs the call), and only the first line of the target file is disclosed. Complete fix is upgrading to >= 5.33.14, which rejects iface values that are not a single path segment.

All signals point to a low-priority, locally-constrained issue despite the library's popularity. The CVSS base score is 3.3 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N: exploitation is local, requires some privilege (PR:L), and yields only limited confidentiality impact (C:L) - disclosure of the first line of a file readable by the Node.js process, with no integrity or availability impact. The vuln.today Decision label is 'monitor', consistent with the low score. No EPSS score and no KEV listing were provided in the input, so there is no evidence of active or widespread exploitation; status is therefore 'no public exploit identified' in KEV terms, but note that the GHSA advisory DOES embed a complete, working proof-of-concept with expected output, so working exploit code is publicly available at the research level. The key tension is between the package's large deployment footprint and its very narrow exploitability: systeminformation is a library with no network endpoint, and the reporter explicitly states they did not establish a consuming-application route that forwards remote attacker input to networkStats() and returns its result - so remote exploitability is NOT demonstrated. This is a genuine but low-urgency bug: patch as a routine dependency bump, not an emergency.

On a Linux host, a local low-privileged user who can write to a filesystem location and influence the iface argument passed to networkStats() by a higher-privileged Node.js process plants a fixture directory whose 'operstate' entry is a symlink to a sensitive file (e.g. a root-only file), then supplies a '../'-laden iface value so the library resolves out of /sys/class/net and follows the symlink. The library returns the first line of that file to the caller, crossing a privilege boundary (the GHSA PoC shows a file unreadable by 'nobody' being disclosed via the root process). A complete working PoC with expected output is published in the GHSA advisory; exploitation nonetheless requires local filesystem setup and an application path that forwards attacker-controlled input to the API.