{"id":"CVE-2021-21315","published":"2021-02-16T17:15:13Z","modified":"2026-06-17T03:35:16Z","title":"System Information Library for Node.JS Command Injection","vendor":"Npm package","product":"System Information Library for Node.JS","tier":"core","eol":null,"description":{"text":"The System Information Library for Node.JS (npm package \"systeminformation\") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.","provenance":"source","from":"NVD"},"summary":{"text":"The systeminformation npm package, a Node.js library for retrieving hardware, system and OS information, contains an OS command injection flaw in versions before 5.3.1, where service parameters passed to functions such as si.inetLatency(), si.inetChecksite(), si.services() and si.processLoad() are not properly neutralised. An attacker with local access and low privileges can inject operating system commands through these parameters, provided the application passes untrusted input, including arrays, to those functions without user interaction being required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:06Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.90675,"percentile":0.99803,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-01-18","dueDate":"2022-02-01","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-21315","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-06-01","exploitedFirstSeen":"2021-06-01","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-february-april-2021/","date":"2021-06-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-18&host_type=src&vulnerability=cve-2021-21315","date":"2023-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-17&host_type=src&vulnerability=cve-2021-21315","date":"2023-12-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-18&host_type=src&vulnerability=cve-2021-21315","date":"2024-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-19&host_type=src&vulnerability=cve-2021-21315","date":"2024-01-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-20&host_type=src&vulnerability=cve-2021-21315","date":"2024-01-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-21315","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2021-21315","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2021-21315","date":"2024-01-24"}],"evidenceTotal":442,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525","tags":["Patch"]},{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v","tags":["Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E","tags":["Issue Tracking","Mailing List"]},{"url":"https://security.netapp.com/advisory/ntap-20210312-0007/","tags":["Third Party Advisory"]},{"url":"https://www.npmjs.com/package/systeminformation","tags":["Product"]},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525","tags":["Patch"]},{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v","tags":["Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E","tags":["Issue Tracking","Mailing List"]},{"url":"https://security.netapp.com/advisory/ntap-20210312-0007/","tags":["Third Party Advisory"]},{"url":"https://www.npmjs.com/package/systeminformation","tags":["Product"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: command injection is the exploitation vector","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"there is a command injection vulnerability","start":219,"end":261}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"npm","package":"systeminformation","vulnerableRanges":["<5.3.1"],"patched":["5.3.1"],"from":["GHSA-2m8v-572m-ff2v"],"provenance":"source"}],"advisories":[{"id":"GHSA-2m8v-572m-ff2v","url":"https://github.com/advisories/GHSA-2m8v-572m-ff2v","severity":"HIGH","ecosystem":"npm","package":"systeminformation","vulnerableRanges":["<5.3.1"],"patched":["5.3.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0527","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0527","exploited":true,"exploitedSince":"2022-01-18","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":1,"earliest":"2021-03-01","earliestUrl":"https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC","repos":[{"name":"ForbiddenProgrammer/CVE-2021-21315-PoC","url":"https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC","stars":160,"created":"2021-03-01"},{"name":"alikarimi999/CVE-2021-21315","url":"https://github.com/alikarimi999/CVE-2021-21315","stars":4,"created":"2021-09-07"},{"name":"G01d3nW01f/CVE-2021-21315","url":"https://github.com/G01d3nW01f/CVE-2021-21315","stars":1,"created":"2021-11-10"},{"name":"MazX0p/CVE-2021-21315-exploit","url":"https://github.com/MazX0p/CVE-2021-21315-exploit","stars":0,"created":"2021-07-18"},{"name":"jimahub/scenario-d-kev","url":"https://github.com/jimahub/scenario-d-kev","stars":0,"created":"2026-09-28"}]},"nuclei":[{"id":"CVE-2021-21315","name":"Node.JS System Information Library <5.3.1 - Remote Command Injection","severity":"high","path":"http/cves/2021/CVE-2021-21315.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21315.yaml"}],"first":{"date":"2021-03-01","source":"PoC-in-GitHub","url":"https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-02-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21315","provenance":"source"},{"date":"2021-03-01","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC","provenance":"source"},{"date":"2021-06-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/network-attack-trends-february-april-2021/","provenance":"source"},{"date":"2022-01-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0527","provenance":"source"}],"speed":{"daysToPublicExploit":13,"firstExploitFrom":"PoC-in-GitHub","daysToKev":336},"priority":{"score":68.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1978 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-sebhildebrandt-systeminformation-cve-2020-7752","parents":[{"from":"CVE-2020-7752","to":"CVE-2021-21315","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61","https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525"],"basis":"shared function","functions":["inetChecksite"]}]},{"from":"CVE-2020-7778","to":"CVE-2021-21315","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js","lib/network.js","lib/processes.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8","https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525"],"basis":"shared function","functions":["inetChecksite","inetLatency","processLoad","services"]}]},{"from":"CVE-2020-26245","to":"CVE-2021-21315","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js","lib/network.js","lib/processes.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525"],"basis":"shared function","functions":["inetChecksite","services"]}]}],"children":[{"from":"CVE-2021-21315","to":"CVE-2021-21388","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"5.3.1","toFixed":"5.6.4","daysApart":72},{"kind":"same-code","provenance":"machine","files":["lib/docker.js","lib/internet.js","lib/network.js","lib/processes.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525","https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524","https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46"],"basis":"shared function","functions":["inetChecksite","inetLatency","processLoad","services"]},{"kind":"similar","provenance":"machine","score":0.78,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2020-7778","published":"2020-11-26","fixed":"4.30.2","kev":false},{"cve":"CVE-2020-26245","published":"2020-11-27","fixed":"4.30.5","kev":false},{"cve":"CVE-2020-26274","published":"2020-12-16","fixed":"4.31.1","kev":false},{"cve":"CVE-2021-21315","published":"2021-02-16","fixed":"5.3.1","kev":true},{"cve":"CVE-2021-21388","published":"2021-04-29","fixed":"5.6.4","kev":false},{"cve":"CVE-2023-42810","published":"2023-09-21","fixed":"5.21.7","kev":false},{"cve":"CVE-2024-56334","published":"2024-12-20","fixed":"5.23.7","kev":false}],"package":"npm:systeminformation"}}