{"schemaVersion":3,"id":"CVE-2021-21315","aliases":["DEBIAN-CVE-2021-21315","GHSA-2m8v-572m-ff2v"],"status":"published","duplicateOf":null,"title":"System Information Library for Node.JS Command Injection","description":"The System Information Library for Node.JS (npm package \"systeminformation\") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.","dates":{"published":"2021-02-16T17:00:18.000Z","modified":"2025-10-21T23:35:26.173Z","reserved":null,"kevAdded":["2022-01-18T00:00:00.000Z"],"kevDue":["2022-02-01T00:00:00.000Z"]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.6,"severity":"medium","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.90675,"percentile":0.99804,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.90675},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.90675,"percentile":0.99804}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.90675,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.90675,"percentile":0.99804}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-01-18T00:00:00.000Z","dueDate":"2022-02-01T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"System Information Library for Node.JS Command Injection","description":"In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-21315","label":"nvd.nist.gov/vuln/detail/CVE-2021-21315"}],"vendor":"Npm package","product":"System Information Library for Node.JS","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-01-18T00:00:00.000Z","dueDate":"2022-02-01T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"System Information Library for Node.JS Command Injection","description":"In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-21315","label":"nvd.nist.gov/vuln/detail/CVE-2021-21315"}],"vendor":"Npm package","product":"System Information Library for Node.JS","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html"}],"affected":[{"vendor":"apache","product":"cordova","name":"cordova","label":"cordova","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"10.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.0.0","eol":null,"hubHref":"/vendor/apache/cordova"},{"vendor":"debian","product":"node-systeminformation","name":"node-systeminformation","label":"node-systeminformation","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-systeminformation","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"systeminformation","name":"systeminformation","label":"systeminformation","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/systeminformation","purlType":"npm","versions":[{"text":"< 5.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.3.1","eol":null,"hubHref":null},{"vendor":"sebhildebrandt","product":"systeminformation","name":"systeminformation","label":"systeminformation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.3.1","eol":null,"hubHref":"/vendor/sebhildebrandt/systeminformation"},{"vendor":"systeminformation","product":"systeminformation","name":"systeminformation","label":"systeminformation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.3.1","eol":null,"hubHref":"/vendor/systeminformation/systeminformation"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.npmjs.com/package/systeminformation","label":"www.npmjs.com/package/systeminformation","hostname":"www.npmjs.com","tags":["X Refsource MISC","WEB","Product"]},{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v","label":"github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Third Party Advisory"]},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525","label":"github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525","hostname":"github.com","tags":["X Refsource MISC","WEB","Patch"]},{"url":"https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","WEB","Issue Tracking"]},{"url":"https://security.netapp.com/advisory/ntap-20210312-0007/","label":"security.netapp.com/advisory/ntap-20210312-0007/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315","hostname":"www.cisa.gov","tags":["Government Resource","WEB","US Government Resource"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21315","label":"security-tracker.debian.org/tracker/CVE-2021-21315","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21315","label":"nvd.nist.gov/vuln/detail/CVE-2021-21315","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/sebhildebrandt/systeminformation","label":"github.com/sebhildebrandt/systeminformation","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20210312-0007","label":"security.netapp.com/advisory/ntap-20210312-0007","hostname":"security.netapp.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2021-02-16T17:00:18.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-01-18T00:00:00.000Z","label":"Added to CISA KEV","detail":"System Information Library for Node.JS Command Injection","source":"cisa"},{"kind":"kev-due","date":"2022-02-01T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:35:26.173Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:36:19.846Z","stale":false,"partial":false}}