{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/mborne/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mborne:extract:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110639"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@mborne/extract (\u003c 0.2.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["mborne"],"content_html":"\u003cp\u003eThe @mborne/extract Node.js library contains an OS command injection vulnerability, identified as CVE-2026-110639, affecting all versions prior to 0.2.1. The vulnerability stems from improper input validation when handling the 'archivePath' or 'targetDir' options. These parameters are passed directly into 'shelljs.exec()' calls within the library's internal extractors (unzip, 7z, tar-bz2, and gz) without sufficient sanitization.\u003c/p\u003e\n\u003cp\u003eIf a downstream application accepts user-supplied input and passes it into the extract() function, an attacker can supply shell metacharacters to escape the intended command context and execute arbitrary system commands. Because these processes run with the privileges of the underlying Node.js application, this vulnerability poses a significant risk for remote code execution (RCE) in any environment utilizing vulnerable versions of the package.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary command execution on the host system running the Node.js application. This potentially leads to full system compromise, data exfiltration, or lateral movement within the network, depending on the permissions of the user account running the Node.js process. The CVSS v3.1 base score is 9.8, reflecting the high potential for total system compromise without authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the @mborne/extract library to version 0.2.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview all application code paths where user-supplied input is passed to the extract() function to ensure no untrusted content can influence file paths.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege by running the Node.js service account with the minimum necessary filesystem and shell access permissions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:33:30Z","date_published":"2026-10-14T16:33:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mborne-extract-rce/","summary":"The @mborne/extract library before version 0.2.1 is vulnerable to OS command injection via unsanitized archivePath or targetDir inputs passed to shelljs exec().","title":"OS Command Injection in @mborne/extract","url":"https://feed.craftedsignal.io/briefs/2026-10-mborne-extract-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Mborne","version":"https://jsonfeed.org/version/1.1"}