This vulnerability allows attackers to execute arbitrary OS commands by supplying shell metacharacters in the archivePath or targetDir options of the @mborne/extract library. The library passes these unsanitized values to shelljs exec() in its unzip, 7z, tar‑bz2 and gz extractors, running them with the Node.js process privileges. Consequently, an attacker who can control these parameters can run arbitrary code on the host, compromising confidentiality, integrity, and availability.

Versions of @mborne/extract prior to 0.2.1 are vulnerable. Any project that includes this package with a version up to 0.2.0 is at risk. The issue is resolved in release 0.2.1.

The CVSS score of 9.3 indicates a severe risk for remote code execution. The EPSS score of 3% indicates a low but measurable likelihood of exploitation, while the lack of mention in the CISA KEV catalog does not reduce the potential danger. Attackers can exploit the flaw by supplying crafted archivePath or targetDir arguments when calling extract(), injecting commands into the process. If the library is used in a publicly exposed service, the vulnerability could be triggered by an external threat actor.