GitHub Advisoryadvisory · npm

GHSA-jff2-qjw8-5476 Command Injection Vulnerability in systeminformation

HIGH Published 2021-04-06 Modified 2021-04-29 Official page ↗
Aliases
CVE-2021-21388
Ecosystem
npm
Packages
systeminformation
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H
Weaknesses
CWE-77, CWE-78
Reviewed
2021-04-02

Affected packages

• npm systeminformation: < 5.6.4 → fixed in 5.6.4

Description

Impact command injection vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version >= 5.6.4 Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Related

Alias · CVE (1)

  • CVE-2021-21388 systeminformation is an open source system and OS information library for node.js. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References