Read the docs
TI-2026-74133 Aliases CVE-2026-110639GHSA-chf7-hjrj-qwh8

OS command injection in @mborne/extract via archivePath and targetDir

Priority MEDIUM 53CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

@mborne/extract before 0.2.1 contains an OS command injection flaw (CWE-78) in which shell metacharacters in the archivePath or targetDir options are passed into unquoted shelljs exec() strings. An unauthenticated remote attacker who controls these values passed to extract() can run commands with Node.js process privileges in the unzip, 7z, tar-bz2 and gz extractors.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02727 86th percentileScored 2026-11-07
Fix Fixed @mborne/extract (mborne): 0.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mborne@mborne/extractbefore 0.2.10.2.1Patch availableCNA
  • @mborne/extract Vendormborne Affected before 0.2.1 Fixed in 0.2.1 Patch available CNA

Remediation

Update @mborne/extract to version 0.2.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA @mborne/extract (mborne) Fixed in 0.2.1

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110639
  2. 2026-10-14 Alias added: GHSA-chf7-hjrj-qwh8
  3. 2026-10-15 CISA SSVC decision points changed

References

Patch 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences