CVE-2026-110641
8.8HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Authenticated or local attackers who can write files to a watched directory can execute arbitrary shell commands with Runnerty process privileges. They achieve this by placing crafted archive filenames containing shell metacharacters.
Root cause
The package passes unquoted archive file names containing shell metacharacters directly into shelljs exec() calls.
Affected systems
@runnerty/executor-decompress through 3.1.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed release is listed; check pull request #7 or upgrade past 3.1.1 once released. As an interim workaround, restrict write access to watched directories and sanitize incoming archive filenames to block shell metacharacters.
$ npm list @runnerty/executor-decompressAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
References
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L106
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L26
- https://github.com/runnerty/executor-decompress/pull/7
- https://www.vulncheck.com/advisories/runnerty-executor-decompress-through-3.1.1-os-command-injection-via-archive-file-name