$ cve CVE-2021-21315 JSON

CVE-2021-21315 KEV

7.1

HIGH · CVSS 3.1 · EPSS 90.7% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-02-01.

Description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Scoring

CVSS	7.1 (HIGH, v3.1)
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS	90.68% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-78
On CISA KEV	yes — remediate by 2022-02-01
Public exploit	none known
Published	2021-02-16
Last modified	2026-06-17

CISA KEV

Name	System Information Library for Node.JS Command Injection
Added	2022-01-18
Due	2022-02-01
Vendor / product	Npm package / System Information Library for Node.JS
Ransomware use	none reported

Affected (2)

Vendor	Product
apache	cordova
systeminformation	systeminformation

References

→ the Explorer · watch your stack · NVD