Read the docs
TI-2026-74135 Aliases CVE-2026-110641GHSA-2v4p-6p6r-gr94

OS command injection in @runnerty/executor-decompress via file names

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

@runnerty/executor-decompress through 3.1.1 contains an OS command injection flaw (CWE-78) in compress_file. Crafted archive file names are passed into shell commands without proper quoting, so attackers who can name a file dropped into a watched directory can run commands with Runnerty process privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02515 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
runnerty@runnerty/executor-decompressup to 3.1.1—No fix listedCNA
  • @runnerty/executor-decompress Vendorrunnerty Affected up to 3.1.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for @runnerty/executor-decompress.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110641
  2. 2026-10-14 Alias added: GHSA-2v4p-6p6r-gr94
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences