{"id":"CVE-2026-110639","published":"2026-10-14T15:17:17.130","lastModified":"2026-10-16T19:18:44.867","description":"@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mborne/node-extract/blob/v0.2.0/src/extractor/unzip.js#L17-L19","tags":[]},{"url":"https://github.com/mborne/node-extract/commit/585e5b29657379e73c04f6f950ea8dc5319f8ae1","tags":[]},{"url":"https://github.com/mborne/node-extract/pull/8","tags":[]},{"url":"https://github.com/mborne/node-extract/releases/tag/v0.2.1","tags":[]},{"url":"https://www.vulncheck.com/advisories/mborne-extract-before-0.2.1-os-command-injection-via-archivepath-and-targetdir","tags":[]}],"exploitRefs":[{"url":"https://github.com/mborne/node-extract/blob/v0.2.0/src/extractor/unzip.js#L17-L19","tags":[]},{"url":"https://github.com/mborne/node-extract/commit/585e5b29657379e73c04f6f950ea8dc5319f8ae1","tags":[]},{"url":"https://github.com/mborne/node-extract/pull/8","tags":[]},{"url":"https://github.com/mborne/node-extract/releases/tag/v0.2.1","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers to inject OS commands through shell metacharacters in archive extraction parameters, potentially leading to full system compromise when Node.js processes execute these commands with elevated privileges.","exploitability":"Exploitation is straightforward requiring only control over the archivePath or targetDir parameters passed to the extract() function, with no additional preconditions needed.","blast_radius":"The impact could be severe across many applications using this library for archive extraction, potentially allowing attackers to execute arbitrary commands on the system with the privileges of the Node.js process.","remediation":"Upgrade to @mborne/extract version 0.2.1 or later to remediate the OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","nodejs"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:49:00.805Z"}}