---
id: "CVE-2021-21315"
kind: "vulnerability"
aliases: ["CVE-2021-21315"]
title: "Npm package System Information Library for Node.JS: System Information Library for Node.JS Command Injection"
severity: "high"
cvss: 7.8
epss: 0.90675
exploited: true
status: "open"
category: "package"
products: [{"name": "Npm package System Information Library for Node.JS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "node.js", "npm", "package", "systeminformation"]
not_affected_if: ["does-not-use-systeminformation", "name-parameter-not-user-controlled"]
published_at: "2021-02-16T17:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21315", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21315", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21315", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Npm package System Information Library for Node.JS: System Information Library for Node.JS Command Injection

The npm package systeminformation (System Information Library for Node.js) passes a user-supplied name parameter into a shell command without sanitizing it. An attacker who can send a crafted payload can run arbitrary commands on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Npm package System Information Library for Node.JS affected ? fixed ?

## Fix

Upgrade the systeminformation npm package to a version at or above the vendor fix; the exact fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21315
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-21315
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-21315

## From the sources

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_