CVE-2021-21315

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
sebhildebrandt	systeminformation	< 5.3.1

References

https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525Patch
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2vThird Party Advisory
https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3EIssue Tracking, Mailing List
https://security.netapp.com/advisory/ntap-20210312-0007/Third Party Advisory
https://www.npmjs.com/package/systeminformationProduct
https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525Patch
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2vThird Party Advisory
https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3EIssue Tracking, Mailing List
https://security.netapp.com/advisory/ntap-20210312-0007/Third Party Advisory
https://www.npmjs.com/package/systeminformationProduct
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315US Government Resource

Timeline

Published: Feb 16, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 18, 2022
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-213167.8less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing the CVE-2021-213175.3uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before versi CVE-2021-213185.4Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 th CVE-2021-213195.4Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript CVE-2021-213204.3matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content s CVE-2021-2132110.0fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from CVE-2021-213229.8fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a CVE-2021-213235.3Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature a CVE-2021-213246.5GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud CVE-2021-213254.8GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud CVE-2021-213266.5GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud CVE-2021-213277.5GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud