CVE-2021-21315

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 18, 2022
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-213167.8less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing the CVE-2021-213175.3uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before versi CVE-2021-213185.4Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 th CVE-2021-213195.4Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript CVE-2021-213204.3matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content s CVE-2021-2132110.0fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from CVE-2021-213229.8fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a CVE-2021-213235.3Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature a CVE-2021-213246.5GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud CVE-2021-213254.8GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud CVE-2021-213266.5GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud CVE-2021-213277.5GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud