# CVE-2021-21315

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

- Page: https://www.vulneraibility.com/cve/CVE-2021-21315
- CVSS: 7.1
- Known exploited: yes, in CISA KEV since 2022-01-18; CISA due date 2022-02-01
- EPSS: 90.67% (percentile 99.8)
- Unvetted proof-of-concept code on GitHub: 6 GitHub proofs of concept · 1 Nuclei template (first 2021-03-01)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-02-06)
- Weakness: CWE-78
- Also known as: GHSA-2m8v-572m-ff2v
- Published: 2021-02-16

## Affected versions

- sebhildebrandt systeminformation: affected < 5.3.1

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.npmjs.com/package/systeminformation
- [other] https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
- [other] https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525
- [other] https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
- [other] https://security.netapp.com/advisory/ntap-20210312-0007/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.