CVE-2026-110639

Summary

This vulnerability allows attackers to inject OS commands through shell metacharacters in archive extraction parameters, potentially leading to full system compromise when Node.js processes execute these commands with elevated privileges.

Exploitability

Exploitation is straightforward requiring only control over the archivePath or targetDir parameters passed to the extract() function, with no additional preconditions needed.

Blast radius

The impact could be severe across many applications using this library for archive extraction, potentially allowing attackers to execute arbitrary commands on the system with the privileges of the Node.js process.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to @mborne/extract version 0.2.1 or later to remediate the OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.