CVE-2021-21315

Signals

NVD · CVE-2026-70618 · 4.3 · Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership bNVD · CVE-2026-70617 · 8.1 · Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary groupNVD · CVE-2026-70616 · 6.5 · boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, gorouNVD · CVE-2026-70615 · 9.9 · boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject aCISA KEV · CVE-2026-63077 · 9.8 · JetBrains TeamCity Deserialization of Untrusted Data Vulnerability · Added 2026-08-05 · Due 2026-08-08CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-70618 · 4.3 · Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership bNVD · CVE-2026-70617 · 8.1 · Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary groupNVD · CVE-2026-70616 · 6.5 · boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, gorouNVD · CVE-2026-70615 · 9.9 · boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject aCISA KEV · CVE-2026-63077 · 9.8 · JetBrains TeamCity Deserialization of Untrusted Data Vulnerability · Added 2026-08-05 · Due 2026-08-08CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07

CVE Database · CVE-2021-21315

CVE-2021-21315

· HIGHAnalyzed

CVSS v3.1

7.1

EPSS

90.67%

Published

Feb 16, 2021

Modified

Oct 24, 2025

CISA Known Exploited Vulnerability

Added: 2022-01-18 · Due: 2022-02-01

Apply updates per vendor instructions.

Public PoC / Exploit (7)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index GitHub PoCForbiddenProgrammer/CVE-2021-21315-PoC★160 GitHub PoCalikarimi999/CVE-2021-21315★4 GitHub PoCG01d3nW01f/CVE-2021-21315★1 GitHub PoCMazX0p/CVE-2021-21315-exploit★0 GitHub PoCxMohamed0/CVE-2021-21315-POC★0

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weaknesses (CWE)

CWE-78CWE-78

Affected Products (2)

systeminformation · systeminformation (up to 5.3.1)vulnerable

apache · cordovavulnerable

References (11)

https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525

Patch

https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v

Third Party Advisory