CVE-2021-21315

System Information Library for Node.JS Command Injection

Systeminformation

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() …

16. Feb 2021

Ausgewertete Quellen

• Hinweis
  https://security.netapp.com/advisory/ntap-20210312-0007/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315
• CISA
  System Information Library for Node.JS Command Injection
• NVD
  CVE-2021-21315
• GitHub
  https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v