CVE-2021-21315 kev in the critical feed json
Command Injection Vulnerability
published 2021-02-16 5 y ago modified 2026-07-08 4 mo ago also GHSA-2m8v-572m-ff2v , EUVD-2021-0527
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-01-18
- epss
- 90.7%
- EPSS 90.7% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Patch / fix
cisa required action Apply updates per vendor instructions.
- npm systeminformation 5.3.1
- systeminformation systeminformation 5.3.1
Timeline
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-02-01 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Npm package, System Information Library for Node.JS
- CISA name
- System Information Library for Node.JS Command Injection
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
90.67% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Node.JS System Information Library <5.3.1 - Remote Command Injection nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | systeminformation | <5.3.1 |
5.3.1 |
Affected products
- sebhildebrandt systeminformation
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525
web, patch
-
npmjs.com
/package/systeminformation
web, product
-
github.com
/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
web, third-party-advisory
-
lists.apache.org
/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
mailing-list, web, issue-tracking
-
security.netapp.com
/advisory/ntap-20210312-0007/
third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315
government-resource, web, us-government-resource
-
nvd.nist.gov
/vuln/detail/CVE-2021-21315
advisory
-
github.com
/sebhildebrandt/systeminformation
package
-
lists.apache.org
/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E
web
-
security.netapp.com
/advisory/ntap-20210312-0007
web
Sources
- CVE List CVE-2021-21315
- GitHub Advisory GHSA-2m8v-572m-ff2v
- NVD CVE-2021-21315
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.