LowVulnerabilityCVE-2026-116673updated 28 Oct 2026, 21:14 UTC

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

Fixed in systeminformation 5.33.14Official source

Severity	LowCVSS 3.3 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yessysteminformation 5.33.14 · since 28 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
systeminformation · npm	< 5.33.14	5.33.14

Timeline

28 Oct 2026, 21:13 UTC
Publicly disclosed
28 Oct 2026, 21:13 UTC
Reported by GitHub Advisory · GitHub Advisory
28 Oct 2026, 21:14 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netGitHub Advisory · 28 Oct 2026, 21:13 UTC

Technical details

ID: CVE-2026-116673 · GHSA-4vjg-vx72-qq4g
CVSS: 3.3 / 10
Disclosed: 28 Oct 2026, 21:13 UTC
On Zero Radar: 28 Oct 2026, 21:14 UTC (1 min after disclosure)
Last change: 28 Oct 2026, 21:14 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net · Zero Radar