Symlink Traversal Vulnerability in System Information Library for Node.js by SebHildebrandt
CVE-2026-116673

3.3LOW

Key Information:

Vendor

Sebhildebrandt

Status
Systeminformation
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116673?

The systeminformation library for Node.js has a vulnerability that arises from improper handling of the caller-supplied interface value during filesystem checks. This oversight allows an attacker to exploit symlink traversal through malicious directory setups and control over the iface parameter. As a result, sensitive information from files that the Node.js process can read may be exposed. To mitigate this risk, users are advised to upgrade to version 5.33.14 or later, where this vulnerability is addressed.

Affected Version(s)

systeminformation < 5.33.14

References

https://github.com/sebhildebrandt/systeminformation/secur...
x_refsource_CONFIRM
https://github.com/sebhildebrandt/systeminformation/commi...
x_refsource_MISC
https://github.com/sebhildebrandt/systeminformation/relea...
x_refsource_MISC

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.