Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116674— systeminformation: Prototype pollution in `networkStats()` via the interface name

Quick assessment

Affected
sebhildebrandt systeminformation
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

systeminformation 是一个用于 Node.js 的系统与操作系统信息库。在版本 5.33.13 之前， 中的 函数在 FreeBSD、OpenBSD 和 NetBSD 上会将每个网络接口的数据以普通对象形式存储在 缓存中，并使用经过清理的、由调用者控制的接口名称作为索引。若传入 作为接口名称，则不会创建新的缓存条目，而是直接使用继承自 的值。这导致 将 、 、 、 、 、 和 等属性写入 。虽然被污染的属性名称是固定的，且其值来源于接口统计信息，但继承名称冲突和可枚举键可能导致应用程序的分支逻辑、序

CVSS 6.5 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
sebhildebrandt systeminformation < 5.33.13 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116674

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
systeminformation: Prototype pollution in `networkStats()` via the interface name
Source: CVE Program / CVE List V5
Vulnerability Description
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sebhildebrandt systeminformation < 5.33.13 -

II. Public POCs for CVE-2026-116674

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116674

请登录查看更多情报信息。

Other References for CVE-2026-116674 (3)

IV. Related Vulnerabilities

Same product: systeminformation
Same vendor: sebhildebrandt
Same weakness: CWE-1321