Command injection in sebhildebrandt systeminformation
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sebhildebrandt | systeminformation | before 5.3.1 | 5.3.1 | Patch available | CNA |
| — | systeminformation (npm) | before 5.3.1 | 5.3.1 | Patch available | GHSA-2m8v-572m-ff2v |
- systeminformation Vendorsebhildebrandt Affected before 5.3.1 Fixed in 5.3.1 Patch available CNA
- systeminformation (npm) Vendor— Affected before 5.3.1 Fixed in 5.3.1 Patch available GHSA-2m8v-572m-ff2v
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:* | before 5.3.1 | Vulnerable | sebhildebrandt |
| cpe:2.3:a:apache:cordova:10.0.0:*:*:*:*:-:*:* | 10.0.0 | Vulnerable | Apache |
- cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:* Versions before 5.3.1 Vulnerable ·sebhildebrandt
- cpe:2.3:a:apache:cordova:10.0.0:*:*:*:*:-:*:* Versions 10.0.0 Vulnerable ·Apache
Remediation
- Fix · CNA systeminformation (sebhildebrandt) Fixed in 5.3.1
- Fix · GHSA-2m8v-572m-ff2v systeminformation (npm) Fixed in 5.3.1 Advisory →
Timeline
- 2022-01-18 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-21315
- 2026-10-03 Alias added: GHSA-2m8v-572m-ff2v
References
Patch 1
Advisory 3
Other 6
- https://www.npmjs.com/package/systeminformation
- [cordova-issues] 20210224 [GitHub] [cordova-cli] iva2k opened a new issue #549: update systeminformation package to >=5.3.1
- https://github.com/sebhildebrandt/systeminformation
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210312-0007
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315
More sebhildebrandt Systeminformation vulnerabilities
- TI-2026-37031 systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux CVSS 4.0HIGH 8.7
- TI-2023-22901 systeminformation SSID Command Injection Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2025-41734 Command Injection in fsSize() on Windows CVSS 3.1HIGH 8.1
- TI-2020-06270 Command injection in systeminformation CVSS 3.1HIGH 8.8
- TI-2021-04487 Command Injection Vulnerability in systeminformation CVSS 3.1CRITICAL 9.8
- TI-2020-16066 Prototype Pollution leading to Command Injection in systeminformation CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-21315 · CVE Program
- CVE-2021-21315 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-2m8v-572m-ff2v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences