CVE-2026-110639 mborne CVE debrief

Who should care

Defenders responsible for Node.js systems using @mborne/extract should assess exposure and prioritize verification and potential updates. Defenders should prioritize verifying if their systems use @mborne/extract versions before 0.2.1 and assess exposure to potential OS command injection attacks. This includes reviewing system configurations, verifying the version of @mborne/extract in use, and assessing the potential impact of an OS command injection攻击

Why it matters

Defenders should prioritize verifying if their systems use @mborne/extract versions before 0.2.1 and assess exposure to potential OS command injection attacks.

• Potential OS command injection attacks
• Exposure of Node.js systems using @mborne/extract versions before 0.2.1
• Need for verification of system configurations and potential updates

Technical summary

The @mborne/extract package before version 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges. Defenders should prioritize verifying if their systems use @mborne/extract versions before 0.2.1 and assess exposure to potential OS command injection attacks.

Defensive priority

Defenders should prioritize verifying if their systems use @mborne/extract versions before 0.2.1 and assess exposure to potential OS command injection attacks.

Recommended defensive actions

• Verify if @mborne/extract versions before 0.2.1 are used in the environment
• Assess exposure to potential OS command injection attacks
• Update @mborne/extract to version 0.2.1 or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the OS command injection vulnerability in @mborne/extract before 0.2.1. The vulnerability allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. There is no information on known affected systems or exploitation. Defenders should verify if their systems use @mborne/extract versions before 0.2.1 and assess exposure to potential OS command injection attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.