@mborne/extract: OS command injection via archivePath and targetDir
Summary
The Node.js library @mborne/extract, before version 0.2.1, passes the archivePath and targetDir options unquoted into shell command strings in its unzip, 7z, tar-bz2 and gz extractors. An attacker who controls these values can inject shell metacharacters and run arbitrary commands with the privileges of the Node.js process. The risk exists only where an application passes attacker-influenced paths to extract(), for example file names from uploads or paths from user-editable configuration.
Affected
- @mborne/extract versions before 0.2.1 (CNA record: affected 0 to < 0.2.1)
- Extractors: unzip, 7z, tar-bz2 and gz
- Applications that pass untrusted values to archivePath or targetDir
Fixed in
- Fixed in 0.2.1 according to the CVE record and the vendor commit 585e5b2
- The draft GitHub advisory GHSA-r234-8hvm-px9x names 0.3.0 as the patched version
- Install 0.3.0 (newest release) to be safe; confirm against the final advisory
Workaround
- No vendor workaround; upgrading is the fix
- Do not pass untrusted input into archivePath or targetDir
- Validate or allow-list paths built by the application
- Run extraction with minimal privileges
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- No reports of active exploitation found at the time of writing
- A reproduction is contained in the public fix pull request #8
Our recommendation
- Run npm ls @mborne/extract to find direct and transitive usage
- Upgrade to 0.3.0 (or at least 0.2.1) and rebuild the affected applications
- Ensure archive paths are never built from untrusted input
- Run extraction in a sandboxed or low-privilege environment
- Monitor for unexpected child processes spawned by the Node.js application
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Fix commit 585e5b2 github.com
- Pull request #8 github.com
- Release v0.2.1 github.com
- npm package @mborne/extract www.npmjs.com
- Maintainer issue #9 github.com
- Maintainer issue #11 github.com
- OSV entry CVE-2026-110639 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:03.
Original description (NVD)
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
NVD references (5)
- https://github.com/mborne/node-extract/blob/v0.2.0/src/extractor/unzip.js#L17-L19
- https://github.com/mborne/node-extract/commit/585e5b29657379e73c04f6f950ea8dc5319f8ae1
- https://github.com/mborne/node-extract/pull/8
- https://github.com/mborne/node-extract/releases/tag/v0.2.1
- https://www.vulncheck.com/advisories/mborne-extract-before-0.2.1-os-command-injection-via-archivepath-and-tar…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.