{"id":"CVE-2021-21315","kind":"vulnerability","aliases":["CVE-2021-21315"],"related":[],"title":"Npm package System Information Library for Node.JS: System Information Library for Node.JS Command Injection","description":"The System Information Library for Node.JS (npm package \"systeminformation\") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.","summary":"The npm package systeminformation (System Information Library for Node.js) passes a user-supplied name parameter into a shell command without sanitizing it. An attacker who can send a crafted payload can run arbitrary commands on the host.","severity":"high","cvss":7.8,"epss":0.90675,"exploited":true,"exploited_at":"2022-01-18T00:00:00+00:00","products":[{"name":"Npm package System Information Library for Node.JS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","node.js","npm","package","systeminformation"],"not_affected_if":["does-not-use-systeminformation","name-parameter-not-user-controlled"],"how_to_check":null,"fix":"Upgrade the systeminformation npm package to a version at or above the vendor fix; the exact fixed version is unknown from the sources.","status":"open","published_at":"2021-02-16T17:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:33+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:31:33Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the systeminformation npm package to a version at or above the vendor fix; the exact fixed version is unknown from the sources.","reach":"unknown","impact":"high","summary":"The npm package systeminformation (System Information Library for Node.js) passes a user-supplied name parameter into a shell command without sanitizing it. An attacker who can send a crafted payload can run arbitrary commands on the host.","category":"package","who_cares":["node.js","npm","systeminformation"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the server hosting the Node.js app.","analyst_note":"Find the fixed version and affected version range from the NVD or GitHub advisory for CVE-2021-21315, and confirm which API takes the name parameter.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["does-not-use-systeminformation","name-parameter-not-user-controlled"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000471,"input_tokens":2834,"output_tokens":375,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the fixed version and affected version range from the NVD or GitHub advisory for CVE-2021-21315, and confirm which API takes the name parameter.","search":"'-2021':16A,19A '-21315':17A,20A '5.3.1':99C,111C 'allow':136C 'arbitrari':66B 'array':140C 'attack':57B 'check':121C 'collect':84C 'command':13A,52B,67B,103C 'craft':62B 'cve':15A,18A 'detail':89C 'expect':145C 'exploit':28B 'fix':108C 'for':26A 'function':86C 'hardwar':90C 'host':70B 'inform':4A,9A,38B,73C,94C 'information':24A 'inject':14A,104C 'instead':115C 'librari':5A,10A,39B,74C 'library':25A 'name':47B 'node.js':7A,12A,27A,29B,41B,76C 'npm':1A,21A,30B,34B,77C 'open':82C 'os':93C 'packag':2A,31B,35B,78C 'package':22A 'paramet':48B,125C 'pass':42B,128C 'payload':63B 'problem':106C 'reject':138C 'retriev':88C 'run':65B 'sanit':54B,123C,142C 'send':60B 'servic':124C 'shell':51B 'si.inetchecksite':131C 'si.inetlatency':130C 'si.processload':133C 'si.services':132C 'sourc':83C 'string':137C,141C 'suppli':46B 'sure':119C 'system':3A,8A,23A,37B,72C,91C 'systeminform':32B,36B,79C,96C 'upgrad':117C 'user':45B 'user-suppli':44B 'version':98C,110C 'vulner':105C 'without':53B 'work':143C 'workaround':114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-02-16T17:15:13+00:00","kev":{"dateAdded":"2022-01-18","dueDate":"2022-02-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-21315","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21315","severity":null,"published_at":"2022-01-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2021-21315","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21315","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-21315","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21315","severity":null,"published_at":"2021-02-16T17:15:13+00:00","modified_at":"2026-06-17T03:35:16+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}