Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110639@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

Critical 9.8

In plain English

A critical-severity OS command injection in @mborne/extract from mborne. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.7%top 13.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

Affected products (as reported)

Vendor	Product	Versions
mborne	@mborne/extract	0 – before 0.2.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/mborne/node-extract/pull/8 patch, issue-tracking
https://github.com/mborne/node-extract/commit/585e5b29657379e73c04f6f950ea8dc5319f8ae1 patch
v0.2.1 Release Notes release-notes
https://github.com/mborne/node-extract/blob/v0.2.0/src/extractor/unzip.js#L17-L19 technical-description
VulnCheck Advisory: @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir third-party-advisory