MVM assurance · CISA KEV demonstration

Your app is exploitable; MVM protection is not yet proven

CVE-2021-21315 in systeminformation 5.3.0

Non-certifying tier 1

Containment is not proven

Conclusion: EXPLOITABLE_MVM_BENEFIT_NOT_PROVEN. This statement applies only to the exact source revision, artifact, trial, policy, and evidence references recorded below.

Tier 2 was not attempted

The corpus workload and net=false guest are wired, but a certifying admitted-provider attestation root is not yet available.

Reason code: attested_provider_unavailable · Tracking issue: #22

No certifying containment evidence exists for this entry. This page reports a reproduced exploit and the absence of a proven boundary, not a boundary that was tested and held.

Residual risk — remediation is still required

MVM does not repair the array type-confusion or make untrusted service names safe; upgrade systeminformation to 5.3.1 or later.

Evidence identity

Source revision
cf93d929435fd22b895cfbd00e61c83475651e69
Artifact digest
sha256:08db6c24fef18ce1e49b1b1473627e89591a9b7a7caef93169408b504adf71ae
Proof ID
cve-2021-21315-tier1
Trial ID
cve-2021-21315-local
Proof binding
sha256:66ce0dc5097008c95c185035afb4bda59a9701ed1363ebbfe95a5bc8358b21d4
Observation digest
sha256:06bc91d521d20ae33817e5a69aa31df45c8d0588eec335518421ba6adcd5d506
Intelligence snapshot
sha256:815dfd1357d1e99097e3b09db529dfd811459352124f62996bde87b0e951a39b

Non-certifying trial references

Scope and coverage gap

Supply-chain and build-time containment are not covered by the current HTTP-only comparison harness.

Tested boundary: guest->host.process and guest filesystem outside workload root

Advisory and editorial provenance

KEV added
2022-01-18
Selected on
2026-09-05
Attribution
TinyLabs MVM assurance corpus maintainers
Rationale
CISA KEV-listed command injection in a widely used Node.js system-inspection package; compact enough for an auditable real-package demo.

Reproduce and refresh

See README.md for exact commands. Rebuild on input changes and at least quarterly; retire the active page when corpus status changes.

Machine contract: artifact.json · Verified report: comparison-report.json · Checksums: SHA256SUMS