GitHub Advisoryadvisory · npm
GHSA-2m8v-572m-ff2v Command Injection Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2021-21315
- Ecosystem
- npm
- Packages
- systeminformation
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H
- Weaknesses
- CWE-78
- Reviewed
- 2021-02-16
Affected packages
• npm systeminformation: < 5.3.1 → fixed in 5.3.1
Description
Impact
command injection vulnerability
Patches
Problem was fixed with a parameter check. Please upgrade to version >= 5.3.1
Workarounds
If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Related
Alias · CVE (1)
- CVE-2021-21315 The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed… vulnerability
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v web
- https://nvd.nist.gov/vuln/detail/CVE-2021-21315 advisory
- https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525 web
- https://github.com/sebhildebrandt/systeminformation package
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E web
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E web
- https://security.netapp.com/advisory/ntap-20210312-0007 web
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315 web
- https://www.npmjs.com/package/systeminformation web