{"id":"EUVD-2026-111104","enisaUuid":"3a0a64e4-310f-3df7-b378-e880aa8c00e8","description":"systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.","datePublished":"Oct 27, 2026, 4:40:46 PM","dateUpdated":"Oct 27, 2026, 4:40:46 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-7648-jmwf-vw7j\nhttps://github.com/sebhildebrandt/systeminformation/commit/6ff25a1ebc0b1fdc7a8aa3507e46f22007da2969\nhttps://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.13\n","aliases":"CVE-2026-116674\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"a31a5436-2d8c-3367-bca7-b5b9840cf823","product":{"name":"systeminformation","vendor":{"name":"sebhildebrandt"}},"product_version":"\u003c 5.33.13"}],"enisaIdVendor":[{"id":"7e054e41-6639-36a2-9b94-9961a99b69f9","vendor":{"name":"sebhildebrandt"}}],"enisaIdVulnerability":[{"id":"cbbb6bfa-a169-3675-835d-11996f438c8b","vulnerability":{"id":"CVE-2026-116674","description":"systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.","datePublished":"Oct 27, 2026, 4:40:46 PM","dateUpdated":"Oct 27, 2026, 4:40:46 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-7648-jmwf-vw7j\nhttps://github.com/sebhildebrandt/systeminformation/commit/6ff25a1ebc0b1fdc7a8aa3507e46f22007da2969\nhttps://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.13\n","enisa_id":"EUVD-2026-111104\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Oct 28, 2026, 11:00:42 PM","vulnerabilityProduct":[{"id":"b3b87552-b964-34e8-9e80-270fec25ecad","product":{"name":"systeminformation","vendor":{"name":"sebhildebrandt"}},"product_version":"\u003c 5.33.13"}],"vulnerabilityVendor":[{"id":"a401cb67-b87e-359d-ac7c-3d560df9ffad","vendor":{"name":"sebhildebrandt"}}]}}],"enisaIdAdvisory":[]}