CVE-2021-21315highunder attackCWE-78

CVE-2021-21315: high-severity vulnerability in sebhildebrandt systeminformation

Command Injection Vulnerability

Published · Updated

Follow this CVE+ Monitor systeminformation+ Monitor System Information Library for Node.JS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.1epss 91%
from disclosure to weapon13 days
Published on NVDFeb 16
1st PoC+13d
CISA KEV+336d
Action required by CISAfederal deadline: 2022-02-01

Apply updates per vendor instructions.

In short

A Node.js library called 'systeminformation' allows attackers to run unauthorized commands on a server if untrusted data is passed to certain functions like inetLatency() or services(). This happens because the library doesn't properly validate user input before executing system commands.

Technical detail

Command injection vulnerability in systeminformation <5.3.1 where functions (inetLatency, inetChecksite, services, processLoad) fail to sanitize parameters before passing them to shell command execution. Exploitation requires passing array or malicious string parameters to vulnerable functions; impact includes arbitrary command execution with the privileges of the Node.js process. Fixed in version 5.3.1 by implementing proper input validation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
sebhildebrandt · systeminformation
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — sebhildebrandt systeminformation

In the same product, most dangerous first.

CVE-2025-68154HIGHCommand Injection in fsSize() on WindowsEPSS 13.0%CVE-2020-26274MEDIUMCommand Injection Vulnerability in systeminformationEPSS 2.7%CVE-2020-26245HIGHPrototype Pollution leading to Command Injection in systeminformationEPSS 2.2%CVE-2023-42810CRITICALsysteminformation SSID Command Injection VulnerabilityEPSS 2.2%CVE-2026-50289HIGHsysteminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on LinuxEPSS 2.2%CVE-2021-21388HIGHCommand Injection Vulnerability in systeminformationEPSS 1.9%