CVE-2021-21388

Katalog CVE

CVSS 9.8 · Critical EPSS 1,9%

Kerentanan Improper Input Validation pada systeminformation. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.

Rincian

Terbit di NVD

29 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524 patch · advisory pihak ketiga
• https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46 patch · advisory pihak ketiga
• https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f patch · advisory pihak ketiga
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476 advisory pihak ketiga
• https://www.npmjs.com/package/systeminformation product · advisory pihak ketiga