Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-110639: @mborne/extract lets attackers run commands on server
CVE-2026-110639 · published 21 days ago
Summary
The @mborne/extract library, versions before 0.2.1, can be tricked into executing arbitrary system commands when an attacker controls the archivePath or targetDir settings. This could let a bad actor run code with the same rights as your application. Update the library to version 0.2.1 or later to stop the risk.
What to do
- Update mborne @mborne/extract to version 0.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mborne | @mborne/extract | < 0.2.1 |
Original advisory text
@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
References
- https://github.com/mborne/node-extract/releases/tag/v0.2.1 Vendor Advisory
- https://github.com/mborne/node-extract/commit/585e5b29657379e73c04f6f950ea8dc531... Patch
- https://github.com/mborne/node-extract/pull/8 Patch
- https://github.com/mborne/node-extract/blob/v0.2.0/src/extractor/unzip.js#L17-L1... Third Party Advisory
- https://www.vulncheck.com/advisories/mborne-extract-before-0.2.1-os-command-inje... Vendor Advisory
- https://registry.npmjs.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1106... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-110639 Vendor Advisory
- https://github.com/mborne/node-extract Product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.9
Critical
Type
CWE-78OS Command Injection
Timeline
Published14 Oct 2026
Updated30 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta