The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The System Information Library for Node.JS (npm package "systeminformation") is an open source collection
    of functions to retrieve detailed hardware, system and OS information. In systeminformation before version
    5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround
    instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(),
    si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String
    sanitation works as expected. (CVE-2021-21315)

The remote host contains a systeminformation npm module that is prior to  5.3.1. It is, therefore, affected by a command injection vulnerability.  The System Information Library for Node.JS (npm package 'systeminformation') is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. The vulnerability was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), or si.processLoad()... to only allow strings and reject any arrays. String sanitization works as expected.

ID	Name	Product	Family	Severity
408983	SCA: security update for systeminformation (GHSA-2m8v-572m-ff2v)	Tenable Cloud Security	SCA Checks	high
408983	SCA: security update for systeminformation (GHSA-2m8v-572m-ff2v)	Tenable Self-Hosted Container Security	SCA Checks	high
164017	NodeJS System Information Library Command Injection (CVE-2021-21315)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2021-21315

high

Tenable Plugins

high

high

high