systeminformation EUVD-2026-111104

Exploitation requires ALL of: (1) the host runs FreeBSD, OpenBSD, or NetBSD - Linux/Android, macOS, and Windows code paths are incidentally guarded and leave Object.prototype clean; (2) the application passes attacker-controlled input directly as the ifaces argument to si.networkStats() (passing '*', omitting the argument, or using only names from si.networkInterfaces() is unaffected); and (3) the underlying netstat invocation exits successfully, which it does even for an unknown interface. The attacker-supplied name must be '__proto__' (or similar prototype-chain key). Limiting factors beyond the raw CVSS: impact is bounded because only seven fixed property names are written and their values come from interface statistics, not the attacker, so consequences are application-specific name collisions (wrong branching, corrupted for...in serialization/config merging/validation/lookups) rather than arbitrary-key pollution or known RCE. Workarounds per vendor: validate the interface name against si.networkInterfaces() or reject __proto__/constructor/prototype, or never pass untrusted input; upgrading to 5.33.13 is the complete fix.

This is a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, base 6.5) shows the network reachability and lack of required privileges or interaction are offset by High attack complexity, and the vuln.today Decision label is 'this_month' rather than act_now/emergency - consistent with a conditionally-reachable prototype-pollution bug. No EPSS score and no KEV listing were provided, so there is no signal of active or widespread exploitation; status is no public exploit confirmed as weaponized. A public PoC reference exists in the GHSA advisory, but it is not verified as a working end-to-end exploit on the affected platforms - the reporter only verified the pollution primitive on macOS and explicitly could not verify BSD end-to-end exploitation. Two independent preconditions sharply limit real-world risk versus the raw score: the host must run FreeBSD, OpenBSD, or NetBSD (Linux, macOS, and Windows are incidentally guarded and not reachable), and the application must forward attacker-controlled input as the interface name to si.networkStats(). The advisory also notes the attacker controls only which of seven fixed property names appear on Object.prototype, not their values, so this is not an arbitrary-key pollution primitive and I:H should be read as the advisory's deliberately conservative default rather than a measurement. Net: patch within the normal maintenance window (this month); it is a real but bounded, deployment-dependent issue, not a drop-everything flaw.

On a FreeBSD/OpenBSD/NetBSD host, an application forwards an attacker-influenced value (e.g. a request parameter) as the ifaces argument to si.networkStats(). The attacker supplies the interface name '__proto__', causing calcNetworkSpeed() to write seven fixed-name properties (rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, operstate) onto Object.prototype, polluting every object in the Node.js process. A public PoC reference exists in the GHSA advisory (the pollution primitive was verified on macOS); it is not verified as a working end-to-end exploit on the BSD platforms, and CVSS AC:H reflects that a BSD host plus an app forwarding untrusted input are both required.