CVE-2021-21315

The systeminformation npm package, a widely used Node.js library for retrieving hardware, system, and OS details, contains a command injection flaw (CWE-78) in versions before 5.3.1. The flaw is triggered when untrusted, user-controlled parameters are passed to functions such as si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), allowing injected commands to be executed by the underlying operating system. A successful attacker gains the ability to run arbitrary commands with the privileges of the Node.js process on the affected host, potentially enabling further compromise. Any application or service built on the npm package that forwards attacker-influenced input into these functions is affected, including deployments where the library is bundled into other products (e.g., Apache Cordova applications per the CPE data). The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-01-18, indicating exploitation in the wild, and its EPSS score of 90.7% places it in the top percentile for near-term exploitation probability.

What to do: Upgrade the systeminformation npm package to version 5.3.1 or later wherever it appears in your Node.js dependency trees. If upgrading is not immediately possible, sanitize all parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), accepting only plain strings and rejecting arrays. Audit internet-facing Node.js applications (including any Cordova-packaged deployments) for use of these functions and confirm they are patched, per the CISA KEV required action.