CVE-2026-110639

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Remote attackers can execute arbitrary shell commands with the privileges of the Node.js process. They only need the application to pass attacker-controlled input into the archivePath or targetDir arguments of extract().

Root cause

The package passes unquoted archivePath and targetDir values directly into shelljs exec() command strings within multiple extractor modules.

Affected systems

@mborne/extract before 0.2.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade @mborne/extract to version 0.2.1 or later. If patching immediately is not possible, sanitize archivePath and targetDir inputs to reject or strip shell metacharacters before calling extract().

shell

$ npm install @mborne/extract@^0.2.1

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110639