{
  "advisory": {
    "aliases": [
      "GHSA-2m8v-572m-ff2v"
    ],
    "cwes": [
      "CWE-78"
    ],
    "kev_added": "2022-01-18",
    "sources": [
      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315",
      "https://github.com/advisories/GHSA-2m8v-572m-ff2v"
    ]
  },
  "artifact": {
    "comparison_report_input_digest": "sha256:75ad2ab93f5647221c420af39a5a50d98cb3f858e44d251ae03580fd2fb115e2",
    "digest": "sha256:08db6c24fef18ce1e49b1b1473627e89591a9b7a7caef93169408b504adf71ae",
    "intelligence_snapshot_digest": "sha256:815dfd1357d1e99097e3b09db529dfd811459352124f62996bde87b0e951a39b"
  },
  "boundary_claim": false,
  "boundary_crossed": "guest->host.process and guest filesystem outside workload root",
  "conclusion": "EXPLOITABLE_MVM_BENEFIT_NOT_PROVEN",
  "coverage_gap": "Supply-chain and build-time containment are not covered by the current HTTP-only comparison harness.",
  "cve_id": "CVE-2021-21315",
  "editorial": {
    "attribution": "TinyLabs MVM assurance corpus maintainers",
    "rationale": "CISA KEV-listed command injection in a widely used Node.js system-inspection package; compact enough for an auditable real-package demo.",
    "selected_on": "2026-09-05"
  },
  "headline": "Your app is exploitable; MVM protection is not yet proven",
  "package": {
    "affected_version": "5.3.0",
    "ecosystem": "npm",
    "fixed_version": "5.3.1",
    "name": "systeminformation"
  },
  "proof": {
    "boundary_evidence_refs": [
      "mvm:observation:sha256:06bc91d521d20ae33817e5a69aa31df45c8d0588eec335518421ba6adcd5d506",
      "mvm:proof:sha256:66ce0dc5097008c95c185035afb4bda59a9701ed1363ebbfe95a5bc8358b21d4"
    ],
    "observation_digest": "sha256:06bc91d521d20ae33817e5a69aa31df45c8d0588eec335518421ba6adcd5d506",
    "proof_binding_digest": "sha256:66ce0dc5097008c95c185035afb4bda59a9701ed1363ebbfe95a5bc8358b21d4",
    "proof_id": "cve-2021-21315-tier1",
    "trial_id": "cve-2021-21315-local"
  },
  "refresh": {
    "cadence": "on_input_change_and_at_least_quarterly",
    "retirement": "stop_active_publication_when_corpus_status_changes"
  },
  "residual_risk": "MVM does not repair the array type-confusion or make untrusted service names safe; upgrade systeminformation to 5.3.1 or later.",
  "schema": "mvm.assurance.cve-publication/v1",
  "source_revision": "cf93d929435fd22b895cfbd00e61c83475651e69",
  "tier": "tier1_non_certifying",
  "tier2": {
    "blocking_issue": 22,
    "detail": "The corpus workload and net=false guest are wired, but a certifying admitted-provider attestation root is not yet available.",
    "reason_code": "attested_provider_unavailable",
    "status": "skipped"
  }
}