@mborne/extract CVE-2026-110639

Exploitation requires that the application embedding @mborne/extract (versions before 0.2.1) passes attacker-controlled values as the archivePath or targetDir options to extract(), and that one of the affected code paths runs - the unzip, 7z, tar-bz2, or gz extractor (the 7z path additionally requires the 7z binary to be installed). The injected commands execute in the Node.js process's current working directory with its privileges. The key LIMITING factor is that this is a library with no standalone attack surface: if the integrating application only ever passes trusted, application-generated paths, the flaw is not reachable. There is no required user interaction or authentication within the library itself, but the vector depends entirely on the host application's input handling.

This is a textbook CWE-78 OS command injection in a Node.js library, scored 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). The source diff confirms the root cause: user-supplied archivePath/targetDir values were concatenated directly into unquoted shelljs exec() command strings across four extractors (unzip, 7z, tar-bz2, gz), so shell metacharacters and leading-dash option injection both work. The technical impact is high across confidentiality, integrity and availability because injected commands run with full Node.js process privileges. However, the raw CVSS signals OVERSTATE universal remote risk: this is a LIBRARY, not a network service. Exploitation requires the CONSUMING application to pass attacker-controlled values into extract(), so real-world severity is entirely dependent on how downstream apps wire user input (e.g., uploaded filenames) into these options. No EPSS score, KEV listing, or SSVC decision data was provided, and the product is an obscure individually-maintained npm package with a small deployment footprint - so despite the critical technical score, this is more likely a targeted/supply-chain concern than a mass-exploited internet-wide issue. The injection technique is fully disclosed in the public patch diff and committed security test, even though no separate exploit-availability flag was provided.

A web application uses @mborne/extract to unpack user-uploaded archives and passes the uploaded filename or a user-chosen destination directly as archivePath or targetDir. An attacker uploads (or names) an archive like '-o a b;touch pwned;$(id)' so that when extract() builds the unquoted shelljs exec() string, the shell interprets the metacharacters and executes arbitrary commands with the Node.js process's privileges. The exact injection payloads are publicly demonstrated in the fix's committed security test, lowering the effort to reproduce.