@mborne/extract OS Command Injection Risks Node.js Process Privileges

The @mborne/extract Node.js library contains a critical OS command injection vulnerability that allows attackers to execute arbitrary system commands. This flaw, identified as CVE-2026-110639, enables malicious actors to run code with the privileges of the Node.js process. The issue arises when attackers supply shell metacharacters in specific configuration options passed to the library’s extraction functions.

Root cause

The vulnerability stems from improper handling of user-supplied input within the library’s extraction logic. According to the National Vulnerability Database, the flaw is classified under CWE-78, indicating a failure to neutralise special elements that could alter command syntax. The library passes values directly into shelljs exec() strings without adequate quoting or sanitisation. This allows injected characters to be interpreted as executable commands rather than harmless file path data.

Attack path

An attacker must control the values passed to the extract() function to exploit this issue. By supplying malicious shell metacharacters in the archivePath or targetDir options, they can inject commands into the execution string. This affects multiple extractors within the library, including those for unzip, 7z, tar-bz2 and gz formats. The injected commands then execute with the full privileges of the running Node.js process, potentially compromising the host system.

Affected versions

• @mborne/extract versions before 0.2.1 are affected by this vulnerability.
• The issue impacts all extractors included in these earlier releases.
• Versions 0.2.1 and later are not mentioned as affected in the record.

Mitigation

• Upgrade @mborne/extract to version 0.2.1 or later immediately.
• Audit applications using this library for direct user input in path options.
• Restrict input validation to prevent shell metacharacters in archive paths.

What it means for organisations

Security teams should verify whether their applications depend on vulnerable versions of this library. Developers need to review how file paths are handled during archive extraction processes. Supply chain managers must ensure that third-party components are updated to patched versions. Incident response plans should include procedures for detecting unauthorised command execution. Communication with engineering leads is essential to prioritise remediation efforts across all affected services.

Background: Command injection

Command injection occurs when an application passes unsanitised user input to a system shell. The shell interprets this input as executable instructions rather than data. This allows attackers to run arbitrary commands on the host server, potentially leading to full system compromise or data exfiltration.

Read the full guide: Command Injection: How Unsanitised Input Breaks Your Shell

What to do and how to stay safe: @mborne/extract

• Check your dependency tree for @mborne/extract versions prior to 0.2.1.
• Monitor system logs for unexpected command executions from Node.js processes.
• Validate all user inputs passed to archive extraction functions.
• Apply input sanitisation to block shell metacharacters in path arguments.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110639?

The National Vulnerability Database rates CVE-2026-110639 as critical with a CVSS score of 9.3.

Which options in @mborne/extract are vulnerable to injection?

The archivePath and targetDir options passed to the extract() function are vulnerable to shell metacharacter injection.

Does this vulnerability affect all archive formats supported by the library?

Yes, the flaw impacts the unzip, 7z, tar-bz2 and gz extractors within the affected versions.