High severity · published Feb 16, 2021
CVE-2021-21315
Command Injection Vulnerability
In wildKEV
7.8
CVSS
90.7%
EPSS
Yes
On KEV
Description
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)90.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 18, 2022
Federal remediation dueFeb 1, 2022
Ransomware campaign useNot known
Affected products
Which versions
SY
systeminformation · sebhildebrandt
< 5.3.1 · source: vendor, NVD
CO
Cordova · Apache
10.0.0 · source: NVD
SI
System Information Library for Node.JS · Npm package
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21315
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21315
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.npmjs.com/package/systeminformation
x_refsource_CONFIRM
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
x_refsource_MISC
https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525
mailing-list
https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-20210312-0007/
More from systeminformation
8.8
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
7.8
CVE-2026-116576
systeminformation: Windows command injection in services() through Unicode quotation marks
7.8
CVE-2026-44724
systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
7.8
CVE-2024-56334
Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation
6.5
CVE-2026-116674
systeminformation: Prototype pollution in `networkStats()` via the interface name