CVE-2026-116673

In the systeminformation library, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the _network object indexed by the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and values come from interface statistics, but name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior; fixed in version 5.33.13.

In systeminformation prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after sanitizeShellString(). On Windows the sanitizer removes ASCII quotes but permits Unicode quotation marks PowerShell accepts as delimiters, allowing crafted input to terminate the filter and inject a PowerShell expression executed by util.powerShell() with the Node.js process account's permissions.

The systeminformation library for Node.js before version 5.31.7 is vulnerable to OS command injection via the networkInterfaces() function on Linux. The issue stems from improper handling of the source directive in network configuration files, allowing arbitrary command execution.

The systeminformation library for Node.js versions 4.17.0 to 5.31.5 is vulnerable to command injection in the networkInterfaces() function on Linux. This occurs when an active NetworkManager connection profile name contains shell metacharacters that are not properly sanitized before being used in shell commands.

The systeminformation library for Node.js prior to version 5.31.0 is vulnerable to command injection via unsanitized `locate` output in the `versions()` function. An attacker can exploit this flaw to execute arbitrary system commands.

The systeminformation library for Node.js contains a command injection vulnerability in the `wifiNetworks()` function. In the retry code path, the `iface` parameter is not sanitized, allowing an attacker to execute arbitrary OS commands.