CVE-2021-21315 - Npm package System Information Library for Node.JS
AI Vulnerability ContextThe System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatenc...
Overview
A source-backed snapshot of this vulnerability.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Vulnerability status
How serious this vulnerability is and whether it is known to be exploited.
- CVE ID
- CVE-2021-21315
- Vendor/project
- Npm package
- Product
- System Information Library for Node.JS
- Vulnerability name
- System Information Library for Node.JS Command Injection
- Date added
- 2022-01-18
- Due date
- 2022-02-01
- Known ransomware campaign use
- Unknown
- CVSS v3
- 7.1
Exploit context
What the vulnerability is about.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Source evidence
Original public records and references for this page.
Original source
Original source links
Open the public records and source datasets used for this page.