7.1
High
Exploited
CVE-2021-21315 System Information Library for Node.JS Command Injection
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-78
Description
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| systeminformation 5.3 | earliest → < 5.3.1 | 5.3.1 |
References
- www.npmjs.com www.npmjs.com
- github.com github.com
- github.com github.com
- [cordova-issues] 20210224 [GitHub] [cordova-cli] iva2k opened a new issue #549: update systeminformation package to >=5.3.1 lists.apache.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of systeminformation
The 15 CVEs of systeminformation →
CVE-2026-116674
systeminformation is a System and OS information library for node.js
6.5
Medium
CVE-2026-116673
systeminformation is a System and OS information library for node.js
3.3
Low
CVE-2026-116576
systeminformation is a System and OS information library for node.js
7.8
High
CVE-2026-50289
systeminformation is a System and OS information library for node.js
8.7
High