HackerFeeds
All CVEs

CVE-2021-21315

HIGH7.1
CISA KEV

Published 2021-02-16 · Updated 2026-06-17 · Source security-advisories@github.com

Summary

CVE-2021-21315 is a high-severity (CVSS 7.1) vulnerability in Npm package System Information Library for Node.JS. CISA added it to the Known Exploited Vulnerabilities catalog on January 18, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 1, 2022. CISA does not currently list it as used in ransomware campaigns.

All 1 known-exploited Npm package vulnerabilities →

Description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE-78CWE-78

CISA Known-Exploited Vulnerability

Product: Npm package — System Information Library for Node.JS

Name: System Information Library for Node.JS Command Injection

Date added: 2022-01-18 · Due: 2022-02-01

Required action: Apply updates per vendor instructions.

References

View on NVD