Description

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:17.130Z",
  "pubdate": "2026-10-14T15:17:17.130Z",
  "executiveSummary": "The @mborne/extract package, in versions prior to 0.2.1, is susceptible to an OS command injection vulnerability. This flaw arises from the insecure handling of user-supplied input within the package's archive extraction routines.\nSpecifically, the archivePath and targetDir options are passed directly to shelljs exec() calls without adequate sanitization or escaping. This allows an attacker to inject arbitrary shell metacharacters, enabling the execution of malicious commands with the privileges of the Node.js process.\nSuccessful exploitation permits unauthorized system access, data exfiltration, or complete system compromise. The vulnerability affects all implementations using affected extractors including unzip, 7z, tar-bz2, and gz. There are no authentication requirements for exploitation, making it a high-risk security flaw for any application relying on user-provided paths for file extraction.",
  "technicalDetails": "The vulnerability is rooted in the improper implementation of command execution within the library. The @mborne/extract package utilizes the shelljs library to invoke external command-line utilities (such as unzip, 7z, and tar) for archive processing. The underlying issue is the concatenation of unsanitized input parameters—specifically archivePath and targetDir—directly into the shell command strings executed via shelljs exec().\nBecause these strings are not wrapped in quotes or validated against a safe character allowlist, the shell interprets shell metacharacters (e.g., ;, &, |, $()) present within the input strings. An attacker can supply a crafted string that terminates the intended command and appends arbitrary operating system commands, which the shell then executes concurrently or sequentially with the parent process.\nThe attack flow begins when an application passes externally controlled input to the extract() function. For instance, if an attacker provides a path containing '; rm -rf / ;', the resulting shell command construction will execute the archive tool followed by the malicious command. The execution occurs within the context of the Node.js process, granting the attacker the same permissions and environment access as the host application.\nThe affected components include the unzip, 7z, tar-bz2, and gz extraction modules within the package. Since these modules all share the same insecure pattern of invoking shelljs exec(), the entire suite of extraction utilities is compromised. The vulnerability does not require authentication, as the execution is triggered immediately upon the processing of the malicious input string. Network exposure is dependent on the application's implementation; however, any web interface or API that accepts file paths from users as part of an extraction workflow is at immediate risk of remote code execution (RCE).\nPost-exploitation impact is severe, as the attacker gains the ability to execute arbitrary code on the host operating system. This can lead to lateral movement within the network, modification or deletion of sensitive files, persistent backdoor installation, or the exfiltration of credentials and configuration data stored on the system."
}