7.1
Élevée
Exploitée
CVE-2021-21315 System Information Library for Node.JS Command Injection
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-78
Description
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| systeminformation 5.3 | premières → < 5.3.1 | 5.3.1 |
Références
- www.npmjs.com www.npmjs.com
- github.com github.com
- github.com github.com
- [cordova-issues] 20210224 [GitHub] [cordova-cli] iva2k opened a new issue #549: update systeminformation package to >=5.3.1 lists.apache.org
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de systeminformation
Les 15 CVE de systeminformation →
CVE-2026-116674
systeminformation is a System and OS information library for node.js
6.5
Moyenne
CVE-2026-116673
systeminformation is a System and OS information library for node.js
3.3
Faible
CVE-2026-116576
systeminformation is a System and OS information library for node.js
7.8
Élevée
CVE-2026-50289
systeminformation is a System and OS information library for node.js
8.7
Élevée