Node.js Library Flaw Lets Attackers Run OS Commands via Archive Paths

The @mborne/extract Node.js library contains a critical vulnerability that allows attackers to execute arbitrary operating system commands. This flaw exists in versions prior to 0.2.1 and is tracked as CVE-2026-110639. The National Vulnerability Database rates the issue with a CVSS score of 9.3, classifying it as Critical. The weakness stems from improper handling of user-supplied input within the library’s extraction functions.

How does the attack work?

Attackers can exploit this vulnerability by supplying shell metacharacters in the archivePath or targetDir options passed to the extract() function. According to the NVD record, these inputs are injected into unquoted shelljs exec() strings. This occurs within the library’s unzip, 7z, tar-bz2, and gz extractors. The injected commands then execute with the same privileges as the Node.js process running the application.

What components are affected?

The vulnerability impacts the @mborne/extract package published by mborne. Only versions released before 0.2.1 are affected. The flaw is categorized under CWE-78, which refers to OS command injection. The specific attack surface involves the configuration options for archive paths and target directories. Developers using these older versions in their Node.js applications are exposed to this risk.

Is a fix available?

The source material identifies version 0.2.1 as the boundary for this vulnerability. Versions before this release contain the flaw. No specific patch notes or release dates are provided in the available records. Developers should verify their current installed version against this threshold. If an application relies on version 0.2.0 or earlier, it is vulnerable to the described command injection.

What comes next for developers?

Teams should audit their Node.js projects for dependencies on @mborne/extract. Checking the package-lock.json or yarn.lock files will reveal the exact version in use. If the version is below 0.2.1, immediate action is required. Updating to the latest available version is the primary mitigation. Until an update is applied, input validation for archive paths is essential.

What analysts watch for

Security teams usually monitor for unusual shell execution patterns in Node.js processes. Analysts check whether archive extraction tasks trigger unexpected system commands. They examine logs for shell metacharacters in file path arguments. Persistence often involves scripts dropped during extraction. Spread occurs when compromised dependencies are pulled into new projects. Teams verify that input sanitization is applied before passing values to external executors.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: @mborne/extract

• Audit your Node.js project dependencies to identify any usage of @mborne/extract versions prior to 0.2.1.
• Implement strict input validation for archivePath and targetDir parameters to reject shell metacharacters.
• Monitor Node.js process logs for unexpected command executions or anomalies during archive extraction tasks.
• Once the vendor provides an update, upgrade the library to the latest patched version immediately.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110639?

The National Vulnerability Database rates CVE-2026-110639 with a CVSS score of 9.3, which is considered Critical.

Which versions of @mborne/extract are vulnerable?

All versions of the @mborne/extract library prior to 0.2.1 are affected by this OS command injection vulnerability.

How do attackers exploit this flaw?

Attackers supply shell metacharacters in the archivePath or targetDir options, injecting commands into unquoted shelljs exec() strings.