high8.9
CVE-2021-21388
Command Injection Vulnerability in systeminformation
Impact
### Impact command injection vulnerability ### Patches Problem was fixed with a parameter check. Please upgrade to version >= 5.6.4 ### Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | systeminformation | < 5.6.4 | 5.6.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Systeminformation | Systeminformation | before 5.6.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524
- https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46
- https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476
- https://www.npmjs.com/package/systeminformation
- https://github.com/advisories/GHSA-jff2-qjw8-5476
- https://nvd.nist.gov/vuln/detail/CVE-2021-21388