mborne vulnerabilities

Products

• @mborne/extract 1

Latest mborne CVEs

Newest publication first

1. CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

   Published 2026-10-14

   Critical·CVSS 9.3 EPSS 2.7%

   @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted sh...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.