Summary
A critical OS command injection vulnerability in @mborne/extract allows attacker-controlled values in archivePath or targetDir options to be interpreted as shell commands.
When these values reach unquoted shell execution strings in the archive extractors, an attacker may execute commands with the privileges of the Node.js process.
A critical OS command injection vulnerability in @mborne/extract allows attacker-controlled values in archivePath or targetDir options to be interpreted as shell commands.
When these values reach unquoted shell execution strings in the archive extractors, an attacker may execute commands with the privileges of the Node.js process.
Affected context
The vulnerability affects applications using vulnerable @mborne/extract functionality to process archives through its unzip, 7z, tar-bz2, or gz extractors. Risk increases when archivePath or targetDir values can be influenced by an untrusted user, uploaded artifact, external request, or other attacker-controlled source before being passed to extract().
The vulnerability affects applications using vulnerable @mborne/extract functionality to process archives through its unzip, 7z, tar-bz2, or gz extractors. Risk increases when archivePath or targetDir values can be influenced by an untrusted user, uploaded artifact, external request, or other attacker-controlled source before being passed to extract().
Exploit preconditions
- Attack surface: The archive extraction API and its shell-backed extractor implementations
- Required access: The ability to influence the archivePath or targetDir options supplied to extract()
- Trigger point: Construction and execution of shell commands during archive extraction
- Why exploitation is possible: Option values are incorporated into unquoted shelljs exec() command strings, allowing shell metacharacters in untrusted input to alter command interpretation
- Execution context: Injected commands run with the privileges available to the Node.js process
- Attack surface: The archive extraction API and its shell-backed extractor implementations
- Required access: The ability to influence the archivePath or targetDir options supplied to extract()
- Trigger point: Construction and execution of shell commands during archive extraction
- Why exploitation is possible: Option values are incorporated into unquoted shelljs exec() command strings, allowing shell metacharacters in untrusted input to alter command interpretation
- Execution context: Injected commands run with the privileges available to the Node.js process
Why this happens
The underlying flaw is the construction of shell commands by concatenating or interpolating untrusted option values without safe argument handling or effective shell interpretation controls.
Because shelljs exec() processes the resulting strings through a command shell, metacharacters can change the intended command structure and cause additional commands to execute. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection.
The underlying flaw is the construction of shell commands by concatenating or interpolating untrusted option values without safe argument handling or effective shell interpretation controls.
Because shelljs exec() processes the resulting strings through a command shell, metacharacters can change the intended command structure and cause additional commands to execute. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The application process and its accessible files may be compromised
- Credentials, tokens, or other secrets available to the process could be exposed
- Archive contents or application data could be modified or destroyed
- The host or surrounding services could be affected, depending on process privileges and network access
- An attacker may execute arbitrary operating-system commands
- The application process and its accessible files may be compromised
- Credentials, tokens, or other secrets available to the process could be exposed
- Archive contents or application data could be modified or destroyed
- The host or surrounding services could be affected, depending on process privileges and network access
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from archive extraction workflows and reducing trust in path-related options.
Common defensive patterns include:
- Prefer library APIs that accept structured argument arrays or direct filesystem operations instead of shell command strings
- Avoid passing untrusted values through a command shell
- Apply strict path validation, canonicalization, and allowlist-based constraints to archive and destination paths
- Keep extraction destinations isolated and prevent path traversal or writes outside intended directories
- Run the Node.js process with minimal filesystem, operating-system, and network privileges
- Use sandboxing and resource limits where archive processing handles untrusted inputs
- Treat archive metadata and extraction options as untrusted until validated
Mitigation generally focuses on removing shell interpretation from archive extraction workflows and reducing trust in path-related options.
Common defensive patterns include:
- Prefer library APIs that accept structured argument arrays or direct filesystem operations instead of shell command strings
- Avoid passing untrusted values through a command shell
- Apply strict path validation, canonicalization, and allowlist-based constraints to archive and destination paths
- Keep extraction destinations isolated and prevent path traversal or writes outside intended directories
- Run the Node.js process with minimal filesystem, operating-system, and network privileges
- Use sandboxing and resource limits where archive processing handles untrusted inputs
- Treat archive metadata and extraction options as untrusted until validated
How teams detect issues like this
Detection can include static analysis for shelljs exec(), child-process APIs, string interpolation, or concatenation involving archivePath, targetDir, and other external inputs.
Code review should look for shell command construction, missing argument quoting, direct propagation of request or file metadata into extraction options, and archive operations performed with elevated privileges. CI policies can flag shell execution that receives non-constant values, while runtime monitoring can correlate archive-processing requests with unexpected child processes or command activity. Automated code review and software composition analysis tools may help identify related patterns.
Detection can include static analysis for shelljs exec(), child-process APIs, string interpolation, or concatenation involving archivePath, targetDir, and other external inputs.
Code review should look for shell command construction, missing argument quoting, direct propagation of request or file metadata into extraction options, and archive operations performed with elevated privileges. CI policies can flag shell execution that receives non-constant values, while runtime monitoring can correlate archive-processing requests with unexpected child processes or command activity. Automated code review and software composition analysis tools may help identify related patterns.
