← Vulnerability feed

Vulnerability record · CVE-2021-21388 · published 29 April 2021

CVE-2021-21388: Systeminformation improper input validation vulnerability

Systeminformation · Systeminformation

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.

9.8 CVSS 3.1 Critical EPSS 1.9% · top 21.7% CWE-20 · Improper input validationCWE-78 · OS command injection
9.8CVSS 3.1 base score, v2 7.5
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524 PatchThird Party Advisory
https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46 PatchThird Party Advisory
https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f PatchThird Party Advisory
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476 Third Party Advisory
https://www.npmjs.com/package/systeminformation ProductThird Party Advisory
https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524 PatchThird Party Advisory
https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46 PatchThird Party Advisory
https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f PatchThird Party Advisory
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476 Third Party Advisory
https://www.npmjs.com/package/systeminformation ProductThird Party Advisory

Track CVE-2021-21388 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2021-21315systeminformation npm package command injection via service parametersThe Node.js package systeminformation before 5.3.1 passes service parameters to functions such as si.inetLatency(), si.inetChecksite(), si.services()…KEVEPSS 91%analysed9.8CVE-2023-42810Systeminformation command injection vulnerabilitysysteminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem…EPSS 2.2%9.8CVE-2020-26300Systeminformation command injection vulnerabilitysysteminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is …EPSS 1.4%9.8CVE-2020-26245Systeminformation os command injection vulnerabilitynpm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rew…EPSS 2.2%8.8CVE-2026-26318Systeminformation os command injection vulnerabilitysysteminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `l…EPSS 1.3%8.8CVE-2020-26274Systeminformation os command injection vulnerabilityIn systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a s…EPSS 2.7%8.8CVE-2020-7752Systeminformation os command injection vulnerabilityThis affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's param…EPSS 6.7%8.7CVE-2026-50289Systeminformation os command injection vulnerabilitysysteminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injec…EPSS 3.6%

Source: NIST National Vulnerability Database (record CVE-2021-21388), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.