Multiple security vulnerabilities have been identified in the systeminformation package, a Node.js library used to collect system and network information. The flaws involve prototype pollution, path traversal, and command injection in network statistics and service listing features. One issue is stated to affect 5.x releases up to and including 5.33.12; the other two are stated to affect earlier versions. Overall, the risk is elevated because an application that forwards untrusted input to these features may expose sensitive data or allow command execution.
CVE-2026-116674 (CVSS 6.5 — Medium): The network statistics feature can be used for prototype pollution through an attacker-controlled interface name, causing property writes to affect shared object state in the process. On the affected BSD platforms, an application that passes untrusted input to this feature may let an attacker introduce unexpected properties and alter application logic, although no remote code execution path is known.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the systeminformation package, a Node.js library used to collect system and network information. The flaws involve prototype pollution, path traversal, and command injection in network statistics and service listing features. One issue is stated to affect 5.x releases up to and including 5.33.12; the other two are stated to affect earlier versions. Overall, the risk is elevated because an application that forwards untrusted input to these features may expose sensitive data or allow command execution.
CVE-2026-116674 (CVSS 6.5 — Medium): The network statistics feature can be used for prototype pollution through an attacker-controlled interface name, causing property writes to affect shared object state in the process. On the affected BSD platforms, an application that passes untrusted input to this feature may let an attacker introduce unexpected properties and alter application logic, although no remote code execution path is known.[emaillocker id="1283"]
CVE-2026-116673 (CVSS 3.3 — Low): On Linux, the network statistics feature can be abused with a crafted interface value that uses traversal and symbolic links to read the first line of a file outside the intended system network data directory. A local caller who can create the required fixture and control the value passed to the feature may disclose limited file contents, but remote exploitability is not demonstrated.
CVE-2026-116576 (CVSS 7.8 — High): On Windows, the service listing feature can be exploited through a crafted service name containing Unicode quotation marks, allowing an attacker to break out of the generated command filter and execute additional commands. An application that passes untrusted input to this feature may permit command execution with the permissions of the running process.
These vulnerabilities collectively present a significant risk to applications that expose the affected library features to untrusted input, particularly where local access or Windows command execution is possible. The most at risk are applications that forward external data into network statistics or service listing functionality. They should prioritize review of those code paths to ensure only trusted values are processed.
We recommend you to update systeminformation to version 5.33.13, 5.33.14, or 5.33.16 depending on the advisory you are remediating.
The following reports contain further technical details:
[/emaillocker]