Key points
- The National Vulnerability Database rates CVE-2026-110639 as critical with a CVSS score of 9.3.
- The flaw affects versions of the @mborne/extract library prior to 0.2.1.
- Attackers exploit unquoted shelljs exec() strings in unzip, 7z, tar-bz2, and gz extractors.
The @mborne/extract Node.js library contains a critical vulnerability that allows attackers to run arbitrary operating system commands on affected systems. This security flaw exists in all versions of the package released before version 0.2.1. The issue stems from how the library handles file paths during the extraction of compressed archives. Malicious actors can manipulate specific input options to inject harmful shell commands. These commands execute with the same privileges as the Node.js process itself. This exposure poses a significant risk to any application relying on this library for archive management.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-110639 with a critical severity rating of 9.3.
- Researchers identified that the library uses unquoted shelljs exec() strings for archive extraction.
- The flaw was found in the unzip, 7z, tar-bz2, and gz extractors within the package.
- The vulnerability allows command injection via the archivePath or targetDir options.
Who is affected
Any application using the @mborne/extract library before version 0.2.1 is vulnerable to this attack. The flaw specifically impacts the archivePath and targetDir options passed to the extract() function. If an attacker can control these values, they can inject shell metacharacters. This injection occurs in the unzip, 7z, tar-bz2, and gz extractors. The malicious commands run with Node.js process privileges. This means the attacker gains the same access rights as the application. System administrators must check their dependency trees for this specific package. Projects using older versions are exposed to remote code execution risks.
What happens next
No fix has been confirmed yet outside of the version boundary mentioned. Users should verify their current version of @mborne/extract immediately. If the version is below 0.2.1, the system is at risk. Administrators need to assess whether user input reaches these extraction functions. Monitoring logs for unexpected command execution is advisable. The community awaits further guidance from the maintainer. Until a secure version is widely adopted, exposure remains high. Teams should prepare to update their dependencies as soon as possible.
The background in plain language
Command injection occurs when software sends untrusted data to a system shell without proper sanitization. In this case, the library passes file paths directly into shell commands. Attackers exploit this by adding special characters that the shell interprets as instructions. This allows them to run their own code on the server. Teams usually validate all user inputs before processing. Check whether your application accepts file paths from external sources. Ensure that any library handling system calls properly escapes these values. This prevents the shell from executing unintended commands.
Background: Remote code execution vulnerabilities
Monitor for unexpected child processes, sudden spikes in outbound network traffic, and anomalous file creation. Combine static analysis with runtime behavior monitoring to catch execution attempts before they establish persistence or exfiltrate data.
Read the full guide: Detect Remote Code Execution: Signals, Tools, and Blind Spots
What to do and how to stay safe: @mborne/extract
- Audit your project dependencies to identify if you use @mborne/extract before version 0.2.1.
- Review code paths where archivePath or targetDir options are populated with user-supplied data.
- Monitor server logs for unusual command executions or unexpected process spawns.
- Prepare to upgrade to version 0.2.1 or later once the vendor provides an update.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns CVE-2026-110639 a CVSS score of 9.3, which is rated as critical.
Which versions of the library are affected?
All versions of the @mborne/extract library prior to version 0.2.1 are affected by this command injection flaw.
How do attackers exploit this vulnerability?
Attackers supply shell metacharacters in the archivePath or targetDir options to inject commands into unquoted shelljs exec() strings.
