BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2021-21315Command Injection Vulnerability

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

7.8 HIGHEPSS 90.67%⚡ Known Exploited (CISA KEV)NVD: Analyzed

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.1HIGH3.1GitHub_M (CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
4.6MEDIUM2.0NVDAV:L/AC:L/Au:N/C:P/I:P/A:P

CISA required action

⚡ Known exploited · remediation due Feb 1, 2022

Apply updates per vendor instructions.

Details

CVE ID
CVE-2021-21315
Status
Analyzed
Assigner (CNA)
GitHub_M
Published
Feb 16, 2021
Last modified
2026-06-17 03:35 UTC
Weaknesses
  • CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 11:31 UTC.