Critical severity9.8NVD Advisory· Published Oct 14, 2026
CVE-2026-110639
CVE-2026-110639
Description
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <0.2.1
Patches
Vulnerability mechanics
References
5- github.com/mborne/node-extract/blob/v0.2.0/src/extractor/unzip.jsnvd
- github.com/mborne/node-extract/commit/585e5b29657379e73c04f6f950ea8dc5319f8ae1nvd
- github.com/mborne/node-extract/pull/8nvd
- github.com/mborne/node-extract/releases/tag/v0.2.1nvd
- www.vulncheck.com/advisories/mborne-extract-before-0.2.1-os-command-injection-via-archivepath-and-targetdirnvd
News mentions
0No linked articles in our index yet.