The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVE-2021-21315 - High Severity Vulnerability
Simple system and OS information library
Library home page: https://registry.npmjs.org/systeminformation/-/systeminformation-4.26.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/systeminformation/package.json
Dependency Hierarchy: - cordova-10.0.0.tgz (Root Library) - :x: **systeminformation-4.26.10.tgz** (Vulnerable Library)
Found in base branch: master
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Publish Date: 2021-02-16
URL: CVE-2021-21315
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
Release Date: 2021-02-16
Fix Resolution (systeminformation): 4.34.11
Direct dependency fix Resolution (cordova): 10.0.1-nightly.2020.8.5.4e1cada0
Step up your Open Source Security Game with Mend here