CVE-2021-21315
System Information Library for Node.JS Command Injection
Published Feb 16, 2021 · updated Jun 16, 2026 · systeminformation systeminformation
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Timeline
Detection, updates, and resolution for this record.
Feb 16, 2021 · Catalog
Detected
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed
Jan 18, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Feb 1, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed
Required action
Apply updates per vendor instructions.
CISA due date Feb 1, 2022
Affected
- cpe apache/cordova10.0.0
- cpe systeminformation/systeminformationversion unspecified
- vendor Npm package System Information Library for Node.JSversion unspecified
Sources
- CISA KEVCVE-2021-21315
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
cisa.gov - CVE.orgCVE-2021-21315
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-21315
30-day exploitation probability 90.7%
first.org - NIST NVDCVE-2021-21315
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed
nvd.nist.gov