CVE-2021-21315

Read full description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

CVSS 7.1 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.5/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.1: +1.06
Fresh EPSS: 90.67%: +0.45

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 3 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

GreyNoise

Press · 31 Oct 2025, 07:00 · NoiseLetter October 2025 - GreyNoise

BleepingComputer

Press · 22 Jan 2022, 08:00 · CISA adds 17 vulnerabilities to list of bugs exploited in attacks - BleepingComputer

BleepingComputer

Press · 24 Feb 2021, 08:00 · Heavily used Node.js package has a code injection vulnerability - BleepingComputer

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.5 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 2 repos with metrics

Repository	Stars	Forks	Language	Updated
ForbiddenProgrammer/CVE-2021-21315-PoC	160	25	JavaScript	09 Jun 2021, 13:27
xMohamed0/CVE-2021-21315-POC	0	0	Python	14 Nov 2021, 14:53

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.1; EPSS 90.7%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: local access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:22.744333+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

16 Feb 2021, 17:00

First press mention

24 Feb 2021, 08:00

Added to the CISA KEV catalog

18 Jan 2022, 00:00

Latest press mention

31 Oct 2025, 07:00

Score calculated

05 Nov 2026, 13:58

PoCs on GitHub

2 repositories