CVE-2021-21315: System Information Library for Node.JS Command Injection

Vulnerability summary

CVE-2021-21315 is a high (CVSS 7.8) OS Command Injection vulnerability in Npm package System Information Library for Node.JS. It is known to be exploited: CISA lists it, first on 18-01-2022. EPSS estimates a 90.67% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities.

Timeline

1. 16-02-2021
   PublishedVulnerability first disclosed.
2. 18-01-2022
   Added to CISA KEVSystem Information Library for Node.JS Command Injection
3. 01-02-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.