HIGH 8.7 NVD
CVE-2026-110641
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archiv
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
References
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092
- https://github.com/runnerty/executor-decompress/pull/7
- https://www.vulncheck.com/advisories/runnerty-executor-decompress-through-3.1.1-os-command
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-14 via NVD.
vulnfeed aggregates 14864 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.