CVE-2021-21388
High
Description
systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.
SeverityHigh
CVSS8.9
Exploit probability—
ProductSysteminformation
PublishedApr 29, 2021
First seenApr 29, 2021
How to fix
Update
- systeminformation systeminformation5.6.4 or later
- systeminformation5.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| systeminformation systeminformation | v < 5.6.4 | 5.6.4 |
| systeminformationnpm | v < 5.6.4 | 5.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.