Live › vulnerability › CVE-2021-21315
Go to dashboardThe npm package systeminformation (System Information Library for Node.js) passes a user-supplied name parameter into a shell command without sanitizing it. An attacker who can send a crafted payload can run arbitrary commands on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Npm package System Information Library for Node.JS | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Upgrade the systeminformation npm package to a version at or above the vendor fix; the exact fixed version is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
This page as .md · .json · in your agent: get_signal("CVE-2021-21315")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.