CVE-2021-21388
Command Injection Vulnerability in systeminformation
- State
- Published
- Severity
- 8.9 High
- Published
- Apr 29, 2021
- Updated
- Aug 3, 2024
- Reserved
- Dec 22, 2020
Description
systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.9 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H | GitHub_M |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
systeminformationsebhildebrandt |
|
References
- https://www.npmjs.com/package/systeminformation
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476
- https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524
- https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46
- https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.