CVE-2026-110641: fallo de gravedad alta en runnerty @runnerty/executor-decompress
@runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 2.5%
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
runnerty · @runnerty/executor-decompressReferencias
https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L106https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L26https://github.com/runnerty/executor-decompress/pull/7https://www.vulncheck.com/advisories/runnerty-executor-decompress-through-3.1.1-os-command-injection-via-archive-file-name