CVE-2026-110641 Details
Description
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
A command injection vulnerability has been identified in the Runnerty package '@runnerty/executor-decompress' in versions through 3.1.1. This vulnerability allows attackers to execute arbitrary commands by sending specially crafted archive file names to the 'compress_file' function. Attackers who can control the names of files placed in a monitored directory can exploit this issue by injecting command substitutions or unquoted shell metacharacters into 'shelljs' execution calls. The injected commands are executed with the same privileges as the Runnerty process.
Users are advised to update to the latest version of '@runnerty/executor-decompress' where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @runnerty/executor-decompress | <= 3.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |