Key points
- CVE-2026-110639 is rated CVSS 9.3 critical by the NVD.
- The flaw affects @mborne/extract versions prior to 0.2.1.
- Shell metacharacters in path options allow OS command execution.
Attackers who control archive paths in the @mborne/extract Node.js library can execute arbitrary operating system commands. This capability grants them the same privileges as the Node.js process running the application. The vulnerability exists in versions before 0.2.1 and is classified as critical by the National Vulnerability Database.
In plain English
The library fails to properly handle user-supplied paths when extracting files. An attacker can insert special shell characters into the archive path or target directory options. These characters are not quoted correctly when passed to underlying extraction tools like unzip, 7z, tar-bz2, and gz. This allows injected commands to run alongside the extraction process.
The background
The issue is tracked as CVE-2026-110639 and maps to CWE-78, which covers improper neutralisation of special elements. The National Vulnerability Database assigns it a CVSS score of 9.3, indicating a critical severity level. The affected software is the @mborne/extract package maintained by mborne. Any version before 0.2.1 is vulnerable to this specific injection technique.
What changes now
Developers using this library must verify their dependency versions immediately. Applications relying on @mborne/extract for file extraction tasks are exposed to remote code execution if user input influences path options. No patch has been confirmed yet for versions prior to 0.2.1, though the record implies 0.2.1 is the fixed version. Teams should audit their codebases for usage of this package.
The attacker's path
Teams usually encounter this class of flaw when applications process untrusted file paths. The weakness relies on insufficient input sanitisation before passing values to system shells. This stage of an intrusion serves as the initial foothold, converting a data-handling error into full system control. Check whether your services accept external archive locations. Verify that all path inputs are strictly validated and never passed directly to shell commands without proper escaping or quoting mechanisms.
What to do and how to stay safe: @mborne/extract
- Audit your Node.js projects to identify any use of @mborne/extract versions before 0.2.1.
- Review code where archive paths or target directories are derived from user input or external sources.
- Implement strict input validation to reject shell metacharacters in any path-related parameters.
- Monitor logs for unexpected command execution or unusual process spawning during file extraction events.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-110639?
The National Vulnerability Database rates it as critical with a CVSS score of 9.3.
Which versions of @mborne/extract are affected?
All versions before 0.2.1 are vulnerable to this OS command injection flaw.
How do attackers exploit this vulnerability?
By supplying shell metacharacters in the archivePath or targetDir options to the extract() function.
