CVE-2026-110639

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

EUVD-2026-101267

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110639

The @mborne/extract library (versions prior to 0.2.1 ) is vulnerable to OS command injection via the archivePath and targetDir options. The root cause is the use of unquoted shelljs exec() strings within the unzip, 7z, tar-bz2, and gz extractors. An attacker who can control these input values can...