Mborne Extract
Monthly
OS command injection in @mborne/extract versions before 0.2.1 lets an attacker execute arbitrary shell commands with the Node.js process's privileges by supplying shell metacharacters in the archivePath or targetDir options passed to extract(). The flaw is unauthenticated (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) and scored 9.3, with full confidentiality, integrity, and availability impact to the host process, though it is a library with no standalone attack surface - it is only reachable when the integrating application forwards attacker-controlled values into one of the affected extractor paths (unzip, 7z, tar-bz2, or gz; the 7z path additionally requires the 7z binary). No public exploit code was identified at time of analysis, so exploitation is contingent on the host application's input handling rather than on any inherently exposed service.
OS command injection in @mborne/extract versions before 0.2.1 lets an attacker execute arbitrary shell commands with the Node.js process's privileges by supplying shell metacharacters in the archivePath or targetDir options passed to extract(). The flaw is unauthenticated (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) and scored 9.3, with full confidentiality, integrity, and availability impact to the host process, though it is a library with no standalone attack surface - it is only reachable when the integrating application forwards attacker-controlled values into one of the affected extractor paths (unzip, 7z, tar-bz2, or gz; the 7z path additionally requires the 7z binary). No public exploit code was identified at time of analysis, so exploitation is contingent on the host application's input handling rather than on any inherently exposed service.