CVE-2021-21315 KEVPublic exploit High · 7.8 EPSS 90.7%

System Information Library for Node.JS Command Injection

Npm package · System Information Library for Node.JS

Summary

The systeminformation npm package, a Node.js library for retrieving hardware, system and OS information, contains an OS command injection flaw in versions before 5.3.1, where service parameters passed to functions such as si.inetLatency(), si.inetChecksite(), si.services() and si.processLoad() are not properly neutralised. An attacker with local access and low privileges can inject operating system commands through these parameters, provided the application passes untrusted input, including arrays, to those functions without user interaction being required.

Official description · NVD

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Breakdown

68.4 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 3 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 13 days after disclosure.

Disclosed16 Feb 2021day 0
Public exploit codePoC-in-GitHub1 Mar 2021+13 days
First seen exploitedVulnCheck KEV evidence1 Jun 2021+3 mo
Added to CISA KEVEU database agrees18 Jan 2022+11 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

6 related vulnerabilities in the same code over 6 months. The latest fix listed for systeminformation is 5.23.7.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2020-7752Command Injection26 Oct 2020
relatedHigh
Why these are linked:
- Fixed one release later4.27.11 → 4.30.2 (systeminformation)
- Same code patched: internet.js (machine-matched)Functions: inetChecksitecommit 931feca commit 73dce8d commit 11103a4
CVE-2020-7778Prototype Pollution26 Nov 2020
relatedHigh
Why these are linked:
- Fixed one release later4.30.2 → 4.30.5 (systeminformation)
- Same code patched: internet.js, network.js, processes.js, util.js (machine-matched)Functions: inetChecksite, isPrototypePolluted, networkStatsSingle, servicescommit 8113ff0 commit 73dce8d commit 11103a4
CVE-2020-26245Prototype Pollution leading to Command Injection in…27 Nov 2020
relatedHigh
Why these are linked:
- Fixed one release later4.30.5 → 4.31.1 (systeminformation)
- Same code patched: util.js (machine-matched)commit 8113ff0 commit 1faadcb
CVE-2020-26274Command Injection Vulnerability in systeminformation16 Dec 2020
same family
This CVECVE-2021-21315System Information Library for Node.JS Command Injection16 Feb 2021KEV
relatedHigh
Why these are linked:
- Fixed one release later5.3.1 → 5.6.4 (systeminformation)
- Same code patched: docker.js, internet.js, network.js, processes.js (machine-matched)Functions: inetChecksite, inetLatency, processLoad, servicescommit 07daa05 commit 01ef56c commit 0be6fcd
- Similar weakness in the same product (machine-matched)same package + description similarity
CVE-2021-21388Command Injection Vulnerability in systeminformation29 Apr 2021

Fixes in systeminformationnpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

4.30.2CVE-2020-777826 Nov 2020
4.30.5CVE-2020-2624527 Nov 2020
4.31.1CVE-2020-2627416 Dec 2020
5.3.1CVE-2021-2131516 Feb 2021KEV
5.6.4CVE-2021-2138829 Apr 2021
5.21.7CVE-2023-4281021 Sep 2023
5.23.7CVE-2024-5633420 Dec 2024Latest listed

techniques

1 , grouped by in kill-chain order, 1 cited passage 1

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · how it is exploited

command injection is the exploitation vector

there is a command injection vulnerability

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 95 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-21315 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: systeminformation.

npmsysteminformationGHSA-2m8v-572m-ff2v

Upgrade to 5.3.1 or later

npmnpm install systeminformation@5.3.1

The first fix for CVE-2021-21315. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you run	Upgrade to
All versions before 5.3.1	5.3.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

6 links, grouped by NVD tag (5 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 18 Jan 2022. Federal due date 1 Feb 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 18 Jan 2022. EUVD-2021-0527

Public exploitAdvisories link exploit code.

, 30 Oct 2026

90.7%Top 0.2%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.8%).

3.1

7.8High · 7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1978 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9980 20.0/20

Threat reports0 reports 0.0/10

Public exploit code5 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.8 5.5/7

End-of-life productsupported or unknown 0.0

Total68.4

Record

Published: 16 Feb 2021
Modified: 17 Jun 2026
: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in systeminformationnpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Patch 1

US Government Resource 1

Third Party Advisory 2

Mailing List 1

Product 1

How attackers get in

techniques