Search
Find a vulnerability
Search criteria
2 vulnerabilities found for @mborne/extract by mborne
CVE-2026-110639 (GCVE-0-2026-110639)
Vulnerability from nvd – Published: 2026-10-14 14:17 – Updated: 2026-10-14 17:34 Unsupported When Assigned
VLAI
EPSS
VEX
Title
@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir
Summary
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:34 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/mborne/node-extract/pull/8 | patchissue-tracking |
| https://github.com/mborne/node-extract/commit/585… | patch |
| https://github.com/mborne/node-extract/releases/t… | release-notes |
| https://github.com/mborne/node-extract/blob/v0.2.… | technical-description |
| https://www.vulncheck.com/advisories/mborne-extra… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mborne | @mborne/extract |
Affected:
0 , < 0.2.1
(semver)
|
Date Public
2026-09-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110639",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:34:45.374494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:34:58.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40mborne/extract",
"product": "@mborne/extract",
"repo": "https://github.com/mborne/node-extract",
"vendor": "mborne",
"versions": [
{
"lessThan": "0.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani"
}
],
"datePublic": "2026-09-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:17:10.540Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/mborne/node-extract/pull/8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/mborne/node-extract/commit/585e5b29657379e73c04f6f950ea8dc5319f8ae1"
},
{
"name": "v0.2.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/mborne/node-extract/releases/tag/v0.2.1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mborne/node-extract/blob/v0.2.0/src/extractor/unzip.js#L17-L19"
},
{
"name": "VulnCheck Advisory: @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mborne-extract-before-0.2.1-os-command-injection-via-archivepath-and-targetdir"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110639",
"datePublished": "2026-10-14T14:17:10.540Z",
"dateReserved": "2026-10-14T13:07:33.066Z",
"dateUpdated": "2026-10-14T17:34:58.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110639 (GCVE-0-2026-110639)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:17 – Updated: 2026-10-14 17:34 Unsupported When Assigned
VLAI
EPSS
VEX
Title
@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir
Summary
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:34 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/mborne/node-extract/pull/8 | patchissue-tracking |
| https://github.com/mborne/node-extract/commit/585… | patch |
| https://github.com/mborne/node-extract/releases/t… | release-notes |
| https://github.com/mborne/node-extract/blob/v0.2.… | technical-description |
| https://www.vulncheck.com/advisories/mborne-extra… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mborne | @mborne/extract |
Affected:
0 , < 0.2.1
(semver)
|
Date Public
2026-09-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110639",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:34:45.374494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:34:58.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40mborne/extract",
"product": "@mborne/extract",
"repo": "https://github.com/mborne/node-extract",
"vendor": "mborne",
"versions": [
{
"lessThan": "0.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani"
}
],
"datePublic": "2026-09-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:17:10.540Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/mborne/node-extract/pull/8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/mborne/node-extract/commit/585e5b29657379e73c04f6f950ea8dc5319f8ae1"
},
{
"name": "v0.2.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/mborne/node-extract/releases/tag/v0.2.1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mborne/node-extract/blob/v0.2.0/src/extractor/unzip.js#L17-L19"
},
{
"name": "VulnCheck Advisory: @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mborne-extract-before-0.2.1-os-command-injection-via-archivepath-and-targetdir"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110639",
"datePublished": "2026-10-14T14:17:10.540Z",
"dateReserved": "2026-10-14T13:07:33.066Z",
"dateUpdated": "2026-10-14T17:34:58.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}