Runnerty executor-decompress: OS command injection via archive file name
Summary
The Runnerty decompress plugin (@runnerty/executor-decompress) passes archive file names unsanitised into shell commands. An attacker who can name a file placed in a watched directory can inject shell commands. The commands run with the privileges of the Runnerty process. The attack requires that Runnerty processes files from a source an outside party can influence.
Affected
- @runnerty/executor-decompress, versions 0 through 3.1.1
- Affected versions per the CNA record (VulnCheck) and the vulnerability sources; no unaffected version is known.
Fixed in
Unknown. No fixed version or vendor advisory was found. A patch pull request (PR #7) is referenced, but its merge status is unverified.
Workaround
- Find all installations of @runnerty/executor-decompress (lockfiles, deployments) and treat versions up to 3.1.1 as affected.
- Remove the plugin if it is not in use.
- Stop feeding untrusted files into watched or drop directories, such as uploads, SFTP drop folders or mail attachments.
- Run Runnerty under a dedicated least-privilege account with write access limited to required directories.
- Reject or sanitise file names containing shell metacharacters before they reach the plugin. This is a general control, not a tested fix.
- Monitor for unexpected child processes started by the Runnerty service.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV in the sources reviewed.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether Runnerty and this plugin are deployed, and ask the integrator or IT provider.
- Apply the vendor fix once it is published; until then, apply the workarounds above.
- Limit the plugin's inputs to trusted sources and reduce the privileges of the Runnerty process.
- Monitor for unexpected child processes from the Runnerty service and review the logs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- GitHub: index.js (line 106), commit 1a625bb github.com
- GitHub: index.js (line 26), commit 1a625bb github.com
- GitHub: pull request #7 github.com
- npm: @runnerty/executor-decompress www.npmjs.com
- Strix CVE record CVE-2026-110641 www.strix.ai
- Positive Technologies PT-2026-114083 (Vulners) vulners.com
- CVE-2026-110641 (ThreatInt) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:03.
Original description (NVD)
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
NVD references (4)
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L106
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L26
- https://github.com/runnerty/executor-decompress/pull/7
- https://www.vulncheck.com/advisories/runnerty-executor-decompress-through-3.1.1-os-command-injection-via-arch…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.