CVE-2026-26280

In the systeminformation library, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the _network object indexed by the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and values come from interface statistics, but name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior; fixed in version 5.33.13.

In the systeminformation library for Node.js before 5.33.14, the Linux `networkStats(iface)` implementation uses the caller-supplied interface value in an `fs.existsSync()` check and to build `/sys/class/net/<iface>` paths without verifying it is a single interface-name segment or that the resolved path stays under `/sys/class/net`. An attacker controlling `iface` can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. This requires local filesystem setup; the issue is fixed in 5.33.14.

In systeminformation prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after sanitizeShellString(). On Windows the sanitizer removes ASCII quotes but permits Unicode quotation marks PowerShell accepts as delimiters, allowing crafted input to terminate the filter and inject a PowerShell expression executed by util.powerShell() with the Node.js process account's permissions.

The systeminformation library for Node.js before version 5.31.7 is vulnerable to OS command injection via the networkInterfaces() function on Linux. The issue stems from improper handling of the source directive in network configuration files, allowing arbitrary command execution.

The systeminformation library for Node.js versions 4.17.0 to 5.31.5 is vulnerable to command injection in the networkInterfaces() function on Linux. This occurs when an active NetworkManager connection profile name contains shell metacharacters that are not properly sanitized before being used in shell commands.

The systeminformation library for Node.js prior to version 5.31.0 is vulnerable to command injection via unsanitized `locate` output in the `versions()` function. An attacker can exploit this flaw to execute arbitrary system commands.