External risk intelligence

@mborne/extract OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-110639

The vulnerability exists in a software library used for archive extraction. While it is network-reachable if integrated into a public-facing application that processes user-supplied file paths, the library itself is not a standalone service or edge gateway. Public exposure depends entirely on how a developer implements the library within their specific application, making internet-facing exposure possible but not inherent.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in archive extraction software could allow attackers to execute commands on systems if they can control input paths. This could have broad implications if the affected software is used in applications that process external files or data.

Software can run unauthorized commands.
Affects systems processing external files.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by tricking a system into processing a specially crafted archive file. When the `extract` function within the `@mborne/extract` library is called with malicious input for the archive path or target directory, it can lead to the execution of arbitrary commands on the server, leveraging the privileges of the Node.js process.

No special access required.
Crafted archive path or target directory.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the `@mborne/extract` library could allow attackers to execute arbitrary commands on systems running Node.js. This could occur when an application uses the library to extract archives and an attacker can influence the `archivePath` or `targetDir` options, injecting malicious commands through shell metacharacters within unquoted strings in specific extractor functions. The commands would run with the privileges of the Node.js process.

System commands.
User-supplied archive paths/directories.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS command injection vulnerability in `@mborne/extract` affects applications that process user-supplied archive file paths. The first practical step is for application owners to identify where this library is used, confirm if it handles untrusted input, and assess the business criticality of those instances. Once identified and prioritized, teams should plan remediation, which may involve code updates or vendor coordination if the library is part of a third-party solution.

Application owners should own this issue.
Verify untrusted input handling and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the @mborne/extract library used for?

@mborne/extract is a Node.js utility library designed to simplify the process of extracting various types of archive files, such as ZIP, 7z, and TAR, within an application. Developers include it in their software projects to handle file decompression tasks automatically when managing data packages or user uploads.

What does OS command injection mean for CVE-2026-110639?

This vulnerability, classified as CWE-78, occurs because the library fails to properly sanitize input. When the library processes archive paths, it may treat malicious characters as system commands instead of simple file names. An attacker can use these characters to trick the server into running unauthorized instructions with the same system permissions as the Node.js application.

How do attackers trigger this vulnerability?

An attacker must be able to control the 'archivePath' or 'targetDir' values passed to the extract function. If an application blindly accepts these inputs from a user, the attacker can inject shell metacharacters to run commands. The bug is not triggered if the application only uses hardcoded, trusted paths that cannot be manipulated by outside users.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that while the library is not a standalone gateway, your risk depends on how your application uses it. If you integrate this library into an internet-facing application that accepts file paths from users, your system could be reachable by attackers. If the library is only used for internal tasks that do not process external data, the likelihood of an external attack is significantly lower.

What steps should I take if I use this library?

First, locate all instances of @mborne/extract within your codebases. Determine if any of those instances process input directly from users or untrusted external sources. If your application handles such data, prioritize updating to version 0.2.1 or higher. If you cannot update immediately, consider implementing strict input validation to ensure no shell metacharacters are passed to the extraction functions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.