The systeminformation library’s Linux networkStats() function is susceptible to a path traversal issue due to the unsanitized use of a caller-supplied interface name when constructing paths under /sys/class/net. An attacker who can influence the interface argument and create a directory containing a symlinked statistic file can cause the library to read that file and return its first line to the Node.js process, enabling local disclosure of potentially sensitive files on the host.

The flaw affects the systeminformation package by sebhildebrandt in versions prior to 5.33.14. The vulnerability was fixed in release 5.33.14 and later, so any Node.js application that imports the package and calls networkStats() with a user-controllable interface value in those earlier releases is vulnerable.

With a CVSS score of 3.3, this vulnerability is considered low severity; it does not provide remote code execution or data tampering. EPSS is not available, and it is not listed in the CISA KEV catalog. The attack requires local filesystem access: an attacker must create a malicious symlink within a directory that the application can resolve under /sys/class/net. While the risk to a host is limited to local disclosure, any environment running untrusted code with access to systeminformation could be affected.