CVE-2021-21315
Summary
| CVE | CVE-2021-21315 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-02-16 17:15:00 UTC |
| Updated | 2023-11-07 03:29:00 UTC |
| Description | The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected. |
Risk And Classification
EPSS: 0.939600000 probability, percentile 0.998880000 (date 2026-04-28)
CISA KEV: Listed on 2022-01-18; due 2022-02-01; ransomware use Unknown
Problem Types: CWE-78
CISA Known Exploited Vulnerability
| Vendor | Npm package |
|---|---|
| Product | System Information Library for Node.JS |
| Name | System Information Library for Node.JS Command Injection |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2021-21315 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Cordova | 10.0.0 | All | All | All |
| Application | Apache | Cordova | 10.0.0 | All | All | All |
| Application | Systeminformation | Systeminformation | All | All | All | All |
| Application | Systeminformation | Systeminformation | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Command Injection Vulnerability · Advisory · sebhildebrandt/systeminformation · GitHub | CONFIRM | github.com | Third Party Advisory |
| docker, processLoad fixed potential security issue · sebhildebrandt/systeminformation@07daa05 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| [cordova-issues] 20210224 [GitHub] [cordova-cli] iva2k opened a new issue #549: update systeminformation package to >=5.3.1 | lists.apache.org | ||
| CVE-2021-21315 Node.JS Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| systeminformation - npm | MISC | www.npmjs.com | Product, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.