CVE-2026-110639: @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed to exploitation?
Applications using @mborne/extract before 0.2.1 are exposed when an attacker can control the archivePath or targetDir values passed to extract(). This includes paths processed by the unzip, 7z, tar-bz2, or gz extractors.
What does an attacker need to exploit this issue?
The attacker needs the ability to supply shell metacharacters in archivePath or targetDir options. No authentication, user interaction, or special attack conditions are indicated by the provided severity vector.
What privileges would injected commands receive?
Injected commands run with the privileges of the Node.js process executing the extraction operation. The impact includes potential compromise of confidentiality, integrity, and availability.
How can the issue be remediated?
Upgrade @mborne/extract to version 0.2.1 or later. The vulnerability affects versions before 0.2.1.