The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Published 2021-02-16 17:15:13
Updated 2021-03-25 18:41:23
Source GitHub, Inc.
View at NVD,   CVE.org

CVE-2021-21315 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
System Information Library for Node.JS Command Injection
CISA required action:
Apply updates per vendor instructions.
CISA description:
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
Added on 2022-01-18 Action due date 2022-02-01

Exploit prediction scoring system (EPSS) score for CVE-2021-21315

97.25%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-21315

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
4.6
MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P
3.9
6.4
NIST
7.8
HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1.8
5.9
NIST
7.1
HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
2.5
4.0
GitHub, Inc.

CWE ids for CVE-2021-21315

References for CVE-2021-21315

Products affected by CVE-2021-21315

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!