CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-110639 — @mborne/extract before 0.2.1 contains an OS command injection vulnerability that...

·Source: NIST NVD

Updated:

Executive Summary

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

Analysis

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges. CVSS Score: 9.8. Published: 2026-10-14T15:17:17.130.

Indicators of Compromise (1)

CVE (1)
CVE-2026-110639
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 14, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEWPOC

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

CVE-2026-111497
The Hacker News
MEDIUMVulnerability

Cognitive Credit raises $40m to scale specialist data and AI for credit markets

Corporate credit data, analytics, and AI technology provider Cognitive Credit has closed a $40 million strategic growth investment led by Summit Partners with participation from ETFS Capital.

Finextra
LOWVulnerability

Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

[object Object]

CVE-2026-111497
r/cybersecurity