What’s Vulnerable › Vulnerabilities

CVE-2021-21388: Command Injection Vulnerability in systeminformation

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-29 · updated 2026-06-17
• Weakness: CWE-20

Description

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.

Affected products

• sebhildebrandt systeminformation: before 5.6.4 — fixed in 5.6.4

How to fix

Upgrade to a fixed version: sebhildebrandt systeminformation 5.6.4. Check the vendor advisory for mitigations.

References

• https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524
• https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46
• https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476
• https://www.npmjs.com/package/systeminformation
• https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524
• https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46
• https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476
• https://www.npmjs.com/package/systeminformation

Get alerted when CVE-2021-21388 or the next vulnerability affects your stack