{"id":"CVE-2026-110641","revision":"a4172aedf3cf4afb8c1f0ef1c40ec3be","records":[{"revision":"a4172aedf3cf4afb8c1f0ef1c40ec3be","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110641","aliases":[],"title":"@runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name","description":"@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.","state":0,"publishedAt":"2026-10-14T14:17:11.966+00:00","modifiedAt":"2026-10-20T01:23:08.052+00:00","affected":[{"ecosystem":"https://registry.npmjs.org","name":"@runnerty/executor-decompress","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"runnerty\",\n                    \"product\": \"@runnerty/executor-decompress\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"3.1.1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/%40runnerty/executor-decompress\",\n                    \"collectionURL\": \"https://registry.npmjs.org\",\n                    \"repo\": \"https://github.com/runnerty/executor-decompress\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/runnerty/executor-decompress/pull/7","https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L26","https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L106","https://www.vulncheck.com/advisories/runnerty-executor-decompress-through-3.1.1-os-command-injection-via-archive-file-name"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110641","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110641","identifiers":["CVE-2026-110641"]},"retained":false,"historicalAffected":[]}],"coverage":[]}