Skip to content

CVE record · 1 source

CVE-2026-110639

CVSS 9.8

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell…

Vendor: Node.js
Product: Node.js
CVSS: 9.8
EPSS: 0.027 (p86)
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

23

CVE NVD 17d ago

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell…

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values…

CVSS 9.8 CVE-2026-110639 Node.js