~ / search / GHSA-jff2-qjw8-5476

GHSA-jff2-qjw8-5476

Command Injection Vulnerability in systeminformation

Source: GitHub Advisory Database (reviewed) High CVE-2021-21388

Packages

EcosystemPackageAffectedFixed in
npm systeminformation < 5.6.4 5.6.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact command injection vulnerability ### Patches Problem was fixed with a parameter check. Please upgrade to version >= 5.6.4 ### Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

References

External links from the advisory. They lead to third-party sites.