mborne CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL mborne CVE published 2026-10-14

CVE-2026-110639

The @mborne/extract package before version 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. This vulnerability affects Node.js systems using @mborne/extract versions before 0.2.1. Defenders should prioritize verifying if their systems use @mborne/extract versions before 0.2.1 and assess exp [truncated]