CVE-2026-110639

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-110639

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110639.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-110639

Published

2026-10-14T14:17:10Z

Modified

2026-10-15T02:47:28Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

Details

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110639.json"
}

References

Affected packages

Git / github.com/mborne/node-extract

Affected ranges

Type

GIT

Repo

https://github.com/mborne/node-extract

Events

Introduced

Fixed

e06a0a301049ba5a083e5f985024fd1dd0eb470c

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.2.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.1.0

v0.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110639.json"