CVE-2026-110641 in executor-decompress
Summary
by MITRE • 10/14/2026
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in @runnerty/executor-decompress versions through 3.1.1 represents a critical OS command injection flaw that stems from improper neutralization of special elements used in operating system commands. This issue specifically affects the compress_file function, which is designed to handle archive files within automated workflows managed by Runnerty. The core technical failure lies in how the application processes file names provided as input parameters for compression tasks. When an attacker gains the ability to control or influence the naming of a file placed into a directory that is being monitored by the system, they can inject malicious shell metacharacters and command substitution sequences directly into the execution pipeline.
The mechanism of exploitation relies on the underlying use of shelljs exec() calls within the Node.js environment. ShellJS provides JavaScript wrappers for common Unix commands, but when these are executed via a shell interpreter rather than direct system calls, they inherit the risks associated with string-based command construction. In this specific implementation, file names containing characters such as dollar signs followed by parentheses or unquoted semicolons and ampersands are not properly sanitized before being passed to the shell execution engine. This allows an attacker to terminate the intended argument for the compression utility and append arbitrary commands that will be interpreted and executed by the host operating system's command interpreter, typically bash or sh depending on the environment configuration.
The operational impact of this vulnerability is severe due to the privilege context in which Runnerty processes operate. Since these automation tools often run with elevated permissions to manage critical infrastructure tasks, successful exploitation results in remote code execution under the privileges of the Runnerty process account. This grants an attacker full control over the affected system within that security boundary, enabling them to exfiltrate sensitive data, install backdoors, pivot to other systems on the network, or disrupt business operations by modifying or deleting critical files and configurations. The attack vector is particularly dangerous because it does not require direct interaction with a web interface but rather leverages file placement in watched directories, which may be accessible through various means including shared drives, FTP uploads, or compromised adjacent services that allow file creation.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is mapped to the MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands such as sh or bash. The exploitation path also relates to CWE-20 Improper Input Validation, where user-supplied data fails to undergo rigorous sanitization before being processed by a system-level function. To mitigate this risk, immediate updates to @runnerty/executor-decompress beyond version 3.1.1 are required if the vendor has released a patch that addresses input validation. In the interim, organizations should enforce strict file naming policies within watched directories and restrict write permissions to only trusted sources. Additionally, implementing application whitelisting or using system call auditing can help detect anomalous command executions originating from automation processes. Developers reviewing similar codebases should avoid passing unsanitized user input directly into shell exec functions and instead utilize libraries that support direct execution without a shell interpreter where possible, ensuring all special characters are escaped or validated against an allowlist of acceptable inputs.