CVE-2021-21315: systeminformation npm package command injection via service parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows command execution with high impact and is in CISA KEV with very high EPSS, but the local attack vector and low privileges required keep it below critical.

What it is

The Node.js package systeminformation before 5.3.1 passes service parameters to functions such as si.inetLatency(), si.inetChecksite(), si.services() and si.processLoad() without rejecting arrays, allowing OS command injection. The flaw is fixed in 5.3.1, and the vendor notes that string sanitization works as expected. It matters because the package is widely embedded in Node.js applications and monitoring agents, and the vulnerable functions are commonly called with user-influenced input.

Impact

An attacker who can control a parameter passed to the affected functions can execute arbitrary OS commands with the privileges of the Node.js process, leading to full compromise of confidentiality, integrity and availability on that host.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so exploitation is reached through a local or already-authenticated context that can supply input to the vulnerable functions. The record does not describe a remote unauthenticated path.

Exploitation

CVE-2021-21315 is listed in CISA KEV with a due date of 2022-02-01, and EPSS gives a 30-day probability of 0.90675 (99.8th percentile), indicating observed exploitation and very high likelihood. No ransomware campaign use is documented in the record.

What to do

• Upgrade systeminformation to version 5.3.1 or later, which contains the patch commit referenced in the advisory.
• If upgrading is not immediately possible, validate and sanitize all service parameters passed to si.inetLatency(), si.inetChecksite(), si.services() and si.processLoad(), allowing only strings and rejecting arrays.
• Inventory Node.js applications and dependencies that bundle systeminformation, including Cordova-related and NetApp products noted in the references, and confirm their bundled version.
• Restrict local access and privileges on hosts running affected Node.js services to reduce the pool of accounts that can reach the vulnerable functions.
• Monitor vendor advisories for updated guidance, since the record lists Apache Cordova and NetApp as related vendors.

Detection

• Search application and dependency manifests for systeminformation versions below 5.3.1.
• Audit code paths that call si.inetLatency(), si.inetChecksite(), si.services() or si.processLoad() with externally supplied or user-controlled parameters.
• Monitor Node.js process behavior for unexpected child process or shell execution originating from the application.
• Review host logs for command execution anomalies on systems running affected Node.js services.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.