CVE-2021-21388

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.

• CWE-20
• CWE-78
• CWE-78

• https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524Patch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46Patch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35fPatch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476Third Party Advisory
• https://www.npmjs.com/package/systeminformationProduct, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524Patch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46Patch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35fPatch, Third Party Advisory
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476Third Party Advisory
• https://www.npmjs.com/package/systeminformationProduct, Third Party Advisory

Published

Apr 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21382Restund is an open source NAT traversal server. The restund …9.6
• CVE-2021-21383Wiki.js an open-source wiki app built on Node.js. Wiki.js be…5.4
• CVE-2021-21384shescape is a simple shell escape package for JavaScript. In…7.8
• CVE-2021-21385Mifos-Mobile Android Application for MifosX is an Android Ap…7.4
• CVE-2021-21386APKLeaks is an open-source project for scanning APK file for…9.8
• CVE-2021-21387Wrongthink peer-to-peer, end-to-end encrypted messenger with…7.5
• CVE-2021-21389BuddyPress is an open source WordPress plugin to build a com…8.8
• CVE-2021-21390MinIO is an open-source high performance object storage serv…5.9
• CVE-2021-21391CKEditor 5 provides a WYSIWYG editing solution. This CVE aff…6.5
• CVE-2021-21392Synapse is a Matrix reference homeserver written in python (…6.3
• CVE-2021-21393Synapse is a Matrix reference homeserver written in python (…6.5
• CVE-2021-21394Synapse is a Matrix reference homeserver written in python (…6.5