CVE-2026-110641: @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using compress_file are exposed when an attacker can control the name of a file placed into a watched directory. The injected command runs with the privileges of the Runnerty process.
What access does an attacker need to exploit this issue?
The attacker needs the ability to supply or rename a file that is dropped into a watched directory. No user interaction is required.
What filename content can trigger command execution?
Crafted archive file names containing $() command substitutions or unquoted shell metacharacters can be interpreted by shelljs exec() calls and used to inject commands.
Which versions require attention?
Versions through 3.1.1 are identified as affected.