Actively exploited in the wild
System Information Library for Node.JS Command Injection
Npm package - System Information Library for Node.JS · Listed in the CISA KEV since 2022-01-18. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-21315
HighCVSS 7.1KEVSummary
The systeminformation library for Node.js before version 5.3.1 contains a command injection vulnerability. The issue was fixed in version 5.3.1.
Risk Assessment
An attacker could execute arbitrary system commands, potentially leading to application or server compromise.
Recommendation
Update the systeminformation package to version 5.3.1 or later. As a workaround, check or sanitize service parameters passed to functions such as si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() – only allow strings, reject arrays.
Other vulnerabilities in systeminformation
See all- CVE-2026-50289High
The systeminformation library for Node.js before version 5.31.7 is vulnerable to OS command injection via the networkInterfaces() function on Linux. The issue stems from improper handling of the source directive in network configuration files, allowing arbitrary command execution.
- CVE-2026-44724High
The systeminformation library for Node.js versions 4.17.0 to 5.31.5 is vulnerable to command injection in the networkInterfaces() function on Linux. This occurs when an active NetworkManager connection profile name contains shell metacharacters that are not properly sanitized before being used in shell commands.
- CVE-2026-26318High
The systeminformation library for Node.js prior to version 5.31.0 is vulnerable to command injection via unsanitized `locate` output in the `versions()` function. An attacker can exploit this flaw to execute arbitrary system commands.
- CVE-2026-26280High
The systeminformation library for Node.js contains a command injection vulnerability in the `wifiNetworks()` function. In the retry code path, the `iface` parameter is not sanitized, allowing an attacker to execute arbitrary OS commands.
Original NVD description (English source)
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.