Runnerty Executor Decompress
Monthly
OS command injection in Runnerty's @runnerty/executor-decompress package (all versions through 3.1.1) lets an attacker who can control the name of an archive file processed by a compress_file/decompress task execute arbitrary shell commands with the privileges of the Runnerty process. The package builds shell command strings from templates that interpolate the archive filename and then hands them to shelljs exec(), so a filename containing $() command substitution or unquoted shell metacharacters - for example one dropped into a watched or ingested directory - is interpreted by the shell instead of being treated as a literal path. Exploitation requires low-privileged access sufficient to name files in that directory (PR:L) and no user interaction; impact to confidentiality, integrity, and availability is high but is bounded to the Runnerty process's privilege level, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in Runnerty's @runnerty/executor-decompress package (all versions through 3.1.1) lets an attacker who can control the name of an archive file processed by a compress_file/decompress task execute arbitrary shell commands with the privileges of the Runnerty process. The package builds shell command strings from templates that interpolate the archive filename and then hands them to shelljs exec(), so a filename containing $() command substitution or unquoted shell metacharacters - for example one dropped into a watched or ingested directory - is interpreted by the shell instead of being treated as a literal path. Exploitation requires low-privileged access sufficient to name files in that directory (PR:L) and no user interaction; impact to confidentiality, integrity, and availability is high but is bounded to the Runnerty process's privilege level, and no public exploit code or confirmed active exploitation was identified at time of analysis.