CVE-2026-110641
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that…
- Risk score
- 70/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 2.5%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters int…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L106
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L26
- https://github.com/runnerty/executor-decompress/pull/7
- https://www.vulncheck.com/advisories/runnerty-executor-decompress-through-3.1.1-os-command-injection-via-archive-file-name
Original description
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
Last activity 14 Oct 2026. Patch Forecast updates every hour.